The npm package utomo-empal4-riris contains malicious code as part of a large-scale token reward campaign that flooded npm with over 15,000 spam packages in 2024. The malicious payload automatically modifies package metadata and republishes derivative packages with randomized Indonesian-themed names to manipulate developer reputation scores for the tea.xyz token protocol. This activity pollutes the npm registry and undermines package integrity.