The npm package joko-lutis2-sukiwir is part of a malicious campaign linked to tea.xyz token rewards that floods the npm registry with autopublished derivative packages. These packages contain scripts that modify package metadata to remove privacy flags, alter version numbers, and generate randomized Indonesian-themed package names. This behavior aims to inflate developer reputation scores and pollute the npm ecosystem with numerous variants.