The npm package fitri-jengkol39-breki contains malicious code associated with a large-scale spam campaign linked to tea.xyz token rewards. This malware uses autopublish scripts to generate and publish numerous derivative packages with randomized Indonesian-themed names. The payload manipulates package metadata to remove privacy flags and increment version numbers, enabling continuous republishing to pollute the npm registry and inflate developer reputation scores.