The npm package wati-teh85-sluey contains malicious code as part of a large-scale spam campaign linked to the tea.xyz token reward system. It includes autopublish scripts that automatically generate and publish derivative packages with randomized names to manipulate developer reputation scores. The malicious payload modifies package metadata to remove private flags, alters version numbers, and continuously republishes variants to pollute the npm registry.