The npm package budi-keripik22-sluey contains malicious code linked to a large-scale spam campaign associated with tea.xyz token rewards. It includes scripts that automatically generate and publish numerous derivative packages with randomized Indonesian-themed names to manipulate developer reputation scores. The malicious payload alters package.json files by removing private flags, changing version numbers, and continuously republishing variants, thereby polluting the npm registry.