Malicious code in @akunsansan0/susu8 (npm)

@akunsansan0/susu8 is a malicious npm package identified as part of a broader campaign to flood npm with packages designed to game the tea.xyz token reward system. The package contains autopublish scripts (such as auto.js, autopublish.js, and variants) that automatically generate and republish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republication of package variants to the npm registry. This activity is intended to artificially inflate developer reputation scores and claim token rewards from the tea protocol.\n\nThe package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. The attack vector is a compromised/malicious package published directly to npm, designed to propagate itself and create registry pollution.\n\nDevelopers who installed this package should remove it immediately and audit their npm accounts for unauthorized activity or additional malicious packages.