tailwind-utility-kit

{"modified":"2026-08-19T00:00:24Z","published":"2026-08-19T00:00:24Z","schema_version":"1.7.4","id":"MAL-2026-14190","summary":"Malicious code in tailwind-utility-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff)\nThe package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to https://31.97.137.157:45000/icons/109, fetches JSON from that endpoint, and passes the response's `credits` field to `new Function('require','module',...,'Promise', data.credits)`, invoking it with `require`, `process`, and `Buffer`. This is arbitrary attacker-controlled code execution on the host that loads the package, with full Node privileges. A decoy `setDefaultModule` referencing CDN-lookalike domains and a Font Awesome icon path is present as cover-story metadata, and the fragmented URL assembly conceals the bare-IP destination. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a browser-credential-stealer payload delivered via the remote loader.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-utility-kit"},"versions":["1.3.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9","tlsh":"e8c1716546fa31a36a63e0edf30f10027165e313375de931f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"tailwind-utility-kit-1.3.2.tgz","hashes":{"sha1":"c11bc2fa7e86ab39d285c4ca84e1d7f0aecb593c","sha512_sri":"sha512-R5SWbFwVYjhvMIBIF9I3g4MdN8S7jFtOP4N0HsYd6t+inppbWWw4vIQ7JjBsusdR9+ADWUR0V2bvNCwfVY9yCw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-utility-kit/v/1.3.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018258","import_time":"2026-08-19T00:21:14.056983183Z","modified_time":"2026-08-19T00:00:24Z","sha256":"39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff","source":"amazon-inspector","versions":["1.3.2"]}]}}