Malicious code in @akunsansan0/tehpucuk1 (npm)

@akunsansan0/tehpucuk1 is a malicious npm package identified as part of a coordinated campaign to flood the npm registry with packages designed to game the tea.xyz token reward system. The package contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions alongside English variants.

The malicious payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This activity is designed to artificially inflate developer reputation scores and claim token rewards from the tea protocol initiative.

The package was identified through Amazon Inspector and reported by the OpenSSF's malicious-packages project. This represents part of a broader pattern of abuse targeting npm's registry infrastructure and the tea protocol's incentive mechanisms.