tailwind-plugin-kit

{"modified":"2026-08-14T14:11:56Z","published":"2026-08-14T14:11:56Z","schema_version":"1.7.4","id":"MAL-2026-14037","summary":"Malicious code in tailwind-plugin-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af)\nThe package presents itself as a Tailwind CSS plugin toolkit but its exported `getPlugin` function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109) and passes the response's `data.credits` field to `new Function(...)` with a full Node.js execution context (require, module, exports, process, Buffer, globalThis, Promise). Any project following the README instructions and registering the package as a Tailwind plugin (`plugins: [toolkit]`) triggers execution of arbitrary attacker-controlled JavaScript on the developer/build machine. The destination URL is assembled by concatenating separate protocol/domain/path fragments, and the file also contains an unused `setDefaultModule` referencing well-known CDN hostnames (cloudflare, fastly, akamai, cloudfront) as a decoy — the actual network destination is the bare IP, not any CDN. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a second-stage infostealer payload targeting browser credential stores and machine identifiers on the loaded host.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-plugin-kit"},"versions":["1.3.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9","tlsh":"e8c1716546fa31a36a63e0edf30f10027165e313375de931f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"tailwind-plugin-kit-1.3.2.tgz","hashes":{"sha1":"dd75d7b2ab47ad17512e3743e6d81d76b843ace5","sha512_sri":"sha512-gKvtQkkbvKzmZdpgavfmrr5WOXLr6xnl/uYTNSSt047gX7JAtUSEg1M8JfX9S0Sg9NhBuQurVJVtVZYaWq0jdQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-plugin-kit/v/1.3.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017759","import_time":"2026-08-14T14:28:06.642726032Z","modified_time":"2026-08-14T14:11:56Z","sha256":"3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af","source":"amazon-inspector","versions":["1.3.2"]}]}}