tailwind-extension-kit

{"modified":"2026-08-19T00:00:14Z","published":"2026-08-19T00:00:14Z","schema_version":"1.7.4","id":"MAL-2026-14189","summary":"Malicious code in tailwind-extension-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db)\nPackage is presented as a Tailwind CSS utility, but its default export `getPlugin` fetches JSON from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109) and passes the returned `data.credits` field to `new Function(...)` bound with `require`, `process`, `module`, and `Buffer`, then invokes it. Following the README's instruction to register the default export as a Tailwind plugin causes Tailwind to invoke `getPlugin`, executing attacker-controlled JavaScript with full Node.js capabilities on the developer's machine. Cover-story framing (variables named `IconProvider`/`iconDomain`, a CDN hostname map for cloudflare/fastly/akamai/cloudfront, a `/ajax/libs/font-awesome/...` path fragment, a `bearrtoken: \"logo\"` header, and an unused `setDefaultModule` decoy) masks the loader as icon retrieval. Declared runtime dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with browser-credential and cookie-stealer payloads that the fetched code can deploy.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-extension-kit"},"versions":["1.3.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9","tlsh":"e8c1716546fa31a36a63e0edf30f10027165e313375de931f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"tailwind-extension-kit-1.3.2.tgz","hashes":{"sha1":"f15894eb7c6dfdab20dc3df9b95db050f47b3fbe","sha512_sri":"sha512-N7cUNcXYsRZ9HLLM/Mn6FGlrKoygpd440q4xjmpF5pVT90uhM+xYfIY61FHbWt2sK966uM037IG4CDQ2o6BEEQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-extension-kit/v/1.3.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018257","import_time":"2026-08-19T00:21:13.81055379Z","modified_time":"2026-08-19T00:00:14Z","sha256":"7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db","source":"amazon-inspector","versions":["1.3.2"]}]}}