tailwind-modernanimation

{"modified":"2026-08-31T18:01:37Z","published":"2026-08-31T18:01:37Z","schema_version":"1.7.4","id":"MAL-2026-15635","summary":"Malicious code in tailwind-modernanimation (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce)\nThe package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an `eval(atob('...'))` call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's `to` field, fetches JavaScript over plain HTTP from `http://<ip>:443/0x/cls` and `http://<ip>:443/0x/ls`, and executes it via `spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref()`. The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-modernanimation"},"versions":["2.3.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"5d7fc58913c50f877f49d6483db570ad1bcff0d71765d379b7fb43b58c021530","tlsh":"28226db1f7c121581e3ed80617a55dc0a22798bd347086457a6e0fde4b88ef848bfa9c"}],"package_integrity":[{"filename":"tailwind-modernanimation-2.3.8.tgz","hashes":{"sha1":"d0e2bc047aaefcf2a7bfcb39408122ec624d4b28","sha512_sri":"sha512-nNx+3Oj4BvEDfnviHhWkel/F3EDwFA3bhpzwII83oM6CINJzAHEdgZoz32XWXz4yx9O0QilGhzr2mSJDCPH83A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-modernanimation/v/2.3.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019299","import_time":"2026-08-31T18:22:29.299750615Z","modified_time":"2026-08-31T18:01:37Z","sha256":"05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce","source":"amazon-inspector","versions":["2.3.8"]}]}}