The npm package cici-rujaksoto81-riris contains malicious code linked to the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. The malicious payload includes autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files by removing private flags and changing version numbers to continuously republish variants, polluting the npm registry and inflating developer reputation scores for token rewards.