Malicious code detected in tile.json: This appears to be a typosquatting/supply chain attack. The tile name 'tessl/npm-vuepress--plugin-nprogress' mimics the legitimate '@vuepress/plugin-nprogress' package (note the double dash and different namespace). The 'describes' field references the real package 'pkg:npm/%40vuepress/plugin-nprogress@1.9.10' but this tile uses a slightly different version (1.9.1 vs 1.9.10), suggesting an attempt to intercept installations of the legitimate VuePress plugin through dependency confusion or namespace squatting.