Malicious code in @alaska-its/design-tokens (npm)
Malicious code was discovered in the npm package @alaska-its/design-tokens. The package was identified by the OpenSSF malicious packages project and reported via GitHub Security Advisory GHSA-56q2-v4w4-rwhm.
- Disclosed
- Last updated
- Blast radius
- Potentially all projects that depend on @alaska-its/design-tokens
- Ecosystems
- Attack vectors
- Affected entities
- @alaska-its/design-tokens
The npm package @alaska-its/design-tokens was found to contain malicious code. The discovery was credited to the OpenSSF's malicious packages monitoring project, which tracks compromised and intentionally malicious packages across major package registries.
The incident was documented in GitHub Security Advisory GHSA-56q2-v4w4-rwhm and assigned the malicious package identifier MAL-2025-756 in the OpenSSF's malicious packages database.
Any project that installed @alaska-its/design-tokens during the period when the malicious version was available may have been affected. The package has been flagged in the OpenSSF's public malicious packages repository for tracking and remediation purposes.
Indicators of compromise
- Packages
- @alaska-its/design-tokens
Remediation
- Remove @alaska-its/design-tokens from your project dependencies
- Audit your project's dependency tree for any versions of @alaska-its/design-tokens that may have been installed
- Review npm audit logs and package-lock.json files to identify when the package was installed
- If the package was installed, review any code changes or suspicious activity in your project during that period
- Consider using npm's security tools to scan for other potentially compromised dependencies
- Update to a clean, verified version of any design token package if needed, or use an alternative package from a trusted source
Sources
- GitHub Advisory GHSA-56q2-v4w4-rwhm · GitHub Advisory Database
Cite this entry
"Malicious code in @alaska-its/design-tokens (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 26, 2026; last updated July 26, 2026. https://supplychainattack.org/incident/malicious-code-in-alaska-its-design-tokens-npm-zpci48
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @aligntech-cw/alignerfit (npm)
Malicious code was discovered in the npm package @aligntech-cw/alignerfit. The package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2024-1743.
npmCompromised package - resolvedcritical
Malicious code in @akunsansan0/susu10 (npm)
@akunsansan0/susu10 is a malicious npm package containing autopublish scripts designed to automatically generate and republish derivative packages with randomized names to the npm registry. The package was part of a tea.xyz token reward campaign that flooded npm with similar malicious packages.
npmCompromised package - containedcritical
Malicious code in @antv/f-wx (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 packages, including @antv/f-wx. Each version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials via the GitHub API and establishes persistence through CI/CD workflow injection and system daemons.
Mini Shai HuludTeamPCPnpmOtherAccount takeoverCompromised packageMalicious commit - resolvedcritical
Malicious code in @akunsansan0/susu11 (npm)
@akunsansan0/susu11 is a malicious npm package containing autopublish scripts designed to automatically generate and republish derivative packages with randomized names to inflate tea protocol token rewards. The package modifies package.json, changes version numbers, and continuously pollutes the npm registry with variants.
npmCompromised package