The npm package @alaska-its/design-tokens version 1.0.1 contains malicious code. This is identified as a malicious package threat without a CVSS score or detailed technical exploit information. There are no known exploits in the wild reported at this time.