Malicious code in @akunsansan0/teagunz99 (npm)

@akunsansan0/teagunz99 is a malicious npm package identified as part of a coordinated campaign exploiting the tea.xyz token reward system. The package contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and republish derivative packages with randomized names, primarily using Indonesian-themed naming conventions alongside English variants.

The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This attack vector aims to artificially inflate developer reputation scores within the tea protocol ecosystem to claim unwarranted token rewards.

The incident was identified and credited to the OpenSSF's malicious-packages repository. The package represents a form of registry pollution and supply chain abuse targeting the npm ecosystem and the integrity of the tea protocol token distribution system.