The npm package utomo-gorengan47-sukiwir contains malicious code as part of a large-scale spam campaign linked to the tea.xyz token reward system. It includes autopublish scripts that automatically generate and publish derivative packages with randomized names to manipulate developer reputation scores. The malicious payload alters package.json files by removing private flags, changing version numbers, and generating Indonesian-themed package names, continuously republishing variants to pollute the npm registry.