Malicious code in @akunsansan0/susu9 (npm)

@akunsansan0/susu9 is a malicious npm package identified as part of a coordinated campaign to flood the npm registry with packages designed to game the tea.xyz token reward system. The package contains autopublish scripts (such as auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions alongside English variants.\n\nThe malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This attack vector inflates developer reputation scores within the tea protocol ecosystem while simultaneously polluting the public npm registry with unwanted packages.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks such coordinated supply chain attacks. The package has been flagged with identifier MAL-2025-181344.