Malicious code in @akunsansan0/tehpucuk3 (npm)

@akunsansan0/tehpucuk3 is a malicious npm package identified as part of the tea.xyz token reward campaign that flooded npm with fraudulent packages. The package contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute automatically upon installation.\n\nThe malicious payload modifies package.json to remove private flags, alters version numbers, and generates random package names (primarily Indonesian-themed variants, with some English variants) to create derivative packages. These variants are then continuously republished to the npm registry, causing widespread registry pollution.\n\nThe attack is designed to artificially inflate developer reputation scores within the tea protocol ecosystem, enabling attackers to claim token rewards. The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.\n\nDevelopers who installed this package may have unknowingly contributed to registry pollution and fraudulent token claims.