tailwind-opentype

{"modified":"2026-08-05T09:05:34Z","published":"2026-08-05T09:05:34Z","schema_version":"1.7.4","id":"MAL-2026-12222","summary":"Malicious code in tailwind-opentype (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb)\ndist/index.js re-exports a benign Tailwind plugin and appends an eval(atob(...)) payload that runs when the module is required (e.g. from a project's tailwind.config). The decoded payload uses \\u-escaped module names to require('http'), require('https'), and require('child_process'), then queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com) for transactions from a hardcoded attacker address (0xa322E5f3D311D3080e6f01210633e9aDC2490Ef1). The transaction's `to` field is decoded into a pair of C2 IPs, from which an XOR-encoded stage-2 payload is fetched over HTTP at /0x/cls and /0x/ls with an x-payload-b64 header, and executed both via eval() and via a detached spawn('node', ['-e',...]).unref(). Every network destination, module name, and identifier is stored as \\u-escaped sequences and the outer payload is base64-wrapped in eval(atob()) to defeat static review. Loading the module yields full remote code execution on the build host with attacker-controlled, on-chain-resolved payloads.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-opentype"},"versions":["1.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"18ddf24b869d879993117aa93e6ba7d959642f5e7b58b1ef07c90d41b4dc2be5","tlsh":"e7323dea5692ba87cf1b5926fd87570e233104b232ad6f254443dd76b388c8634ad60f"}],"package_integrity":[{"filename":"tailwind-opentype-1.2.3.tgz","hashes":{"sha1":"2276c63ed2b216aefe4050393abffe4fba5145f4","sha512_sri":"sha512-F9CbTj4d4nqpJgDHnIkQQza9/8KK0KBXGF1v30nWCrb6hP+X2F2Q8IaTMEvq7S9OUgcQbDMzf+h0aQ2u2gbvXw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-opentype/v/1.2.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014541","import_time":"2026-08-05T09:28:23.756044183Z","modified_time":"2026-08-05T09:05:34Z","sha256":"bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb","source":"amazon-inspector","versions":["1.2.3"]}]}}