The npm package galih-lutis67-sluey contains malicious code linked to a large-scale spam campaign associated with the tea.xyz token reward system. This campaign involves over 15,000 packages that use autopublish scripts to generate and publish numerous derivative packages with randomized Indonesian-themed names. The malicious payload alters package.json files by removing private flags and changing version numbers to enable continuous republishing. This activity pollutes the npm registry and artificially inflates developer reputation scores tied to the tea protocol token rewards.