The npm package dewanto-peyek65-sluey was identified as containing malicious code linked to a large-scale spam campaign on the npm registry in 2024. This campaign involved over 15,000 packages designed to manipulate developer reputation scores for the tea.xyz token reward system by auto-generating and publishing derivative packages with randomized Indonesian-themed names. The malicious payload modifies package metadata to remove privacy flags and alter version numbers, enabling continuous republishing and registry pollution.