The npm package erwin-soto5-riris contains malicious code linked to a large-scale spam campaign associated with the tea.xyz token reward system. This campaign involves autopublish scripts that automatically generate and publish numerous derivative packages with randomized names to manipulate developer reputation scores. The malicious payload alters package metadata to remove privacy flags, changes version numbers, and continuously republishes variants to flood the npm registry.