The npm package tania-telurtahu22-sluey contains malicious code as part of a large-scale spam campaign linked to tea.xyz token rewards. It includes autopublish scripts that automatically generate and publish derivative packages with randomized names to manipulate developer reputation scores. The payload modifies package.json files to remove private flags, alters version numbers, and continuously republishes variants, causing pollution of the npm registry.