The npm package dewi-pecel55-sluey contains malicious code linked to a large-scale spam campaign associated with tea.xyz token rewards. It includes autopublish scripts that automatically generate and publish numerous derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and alters version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.