core-tailwindcss-utility

{"modified":"2026-08-18T04:43:34Z","published":"2026-08-18T04:43:34Z","schema_version":"1.7.4","id":"MAL-2026-14118","summary":"Malicious code in core-tailwindcss-utility (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83)\nPackage is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin() which fetches JSON from the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108 and passes the response's `credits` field to `new Function(...)` with `require`, `process`, and `Buffer` bound in scope, executing the returned string as Node.js code on the caller's host. A decoy setDefaultModule() constructs cdnjs.<provider> URLs (cloudflare.com, fastly.net, etc.) to disguise the module as a font-awesome/CDN helper, but the actually-invoked path targets the bare-IP C2. Declared dependencies (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3, node-machine-id, socket.io-client, axios) are inconsistent with the stated Tailwind purpose and pre-stage the second-stage payload with primitives for browser credential decryption and remote C2, which the fetched code can load via the bound require.\n","affected":[{"package":{"ecosystem":"npm","name":"core-tailwindcss-utility"},"versions":["3.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b","tlsh":"82c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8"},{"path":"package.json","sha256":"bb7170c12c13ac45f3a725207c8ee2d59f7003ef0c206df6368902b91ebe2b17","tlsh":"64014710ce11dd7305d55187786880969251990b8e41fc4d339647ae0f8e5afa1fe25d"}],"package_integrity":[{"filename":"core-tailwindcss-utility-3.7.1.tgz","hashes":{"sha1":"ca826cd39b332f668c1e75746240d96ad6394992","sha512_sri":"sha512-wjgYcjHg42ux2ujfs9fVRwUbfvsTthx703vf7+lSVrPOWpgjDFnY5K78sr3abtT7vypqZWO0U8VP4Q8IuYSWvA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/core-tailwindcss-utility/v/3.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017984","import_time":"2026-08-18T04:47:05.138382757Z","modified_time":"2026-08-18T04:43:34Z","sha256":"67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83","source":"amazon-inspector","versions":["3.7.1"]}]}}