The npm package andi-telurtahu97-breki contains malicious code associated with the tea.xyz token reward campaign. This campaign flooded the npm registry in 2024 with over 15,000 spam packages. The malicious code includes autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files to remove private flags and change version numbers, enabling continuous republishing to inflate developer reputation scores and pollute the npm registry.