The npm package cindy-gembus55-sluey was identified as containing malicious code as part of a large-scale spam campaign linked to tea.xyz token rewards. This campaign involved flooding the npm registry with over 15,000 spam packages that include autopublish scripts to automatically generate and publish derivative packages with randomized names. The malicious payload modifies package metadata to remove private flags, alters version numbers, and generates random Indonesian-themed package names to continuously republish variants, thereby polluting the npm registry and inflating developer reputation scores.