The npm package dian-ketoprak60-sukiwir contains malicious code linked to a large-scale spam campaign associated with the tea.xyz token reward system. It includes scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names to manipulate developer reputation scores. The malicious payload alters package metadata to remove privacy flags, changes version numbers, and continuously republishes variants, thereby polluting the npm registry.