Malicious code in @akunsansan0/susu2 (npm)

@akunsansan0/susu2 is a malicious npm package identified as part of a coordinated campaign to flood the npm registry with auto-publishing packages. The package contains scripts (such as auto.js, autopublish.js, and variants) that automatically generate and republish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This activity was designed to artificially inflate developer reputation scores for tea protocol token rewards.\n\nThe package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. Any developer who installed @akunsansan0/susu2 or its auto-generated derivatives may have been affected by the malicious behavior.