The npm package eka-papeda50-riris contains malicious code linked to a large-scale token reward campaign on npm. It includes scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names to manipulate developer reputation scores. The payload modifies package metadata to remove private flags and increment version numbers, enabling continuous republishing and pollution of the npm registry.