tailwind-container-queries

{"modified":"2026-09-04T03:45:02Z","published":"2026-09-04T03:45:02Z","schema_version":"1.7.4","id":"MAL-2026-15903","summary":"Malicious code in tailwind-container-queries (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f)\nOn require of the package main, an appended eval(atob(...)) block in dist/index.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth) for the last transaction sent from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes the tx.to field into two IPv4 addresses. It fetches XOR-encrypted payloads from http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, decrypts them with hardcoded keys, eval's the first payload in-process, and launches the second via spawn('node', ['-e', <decoded>], {detached:true, stdio:'ignore', windowsHide:true}).unref() to leave a persistent detached Node process on the host. After execution the loader rewrites dist/index.js on disk to strip the eval block, removing the payload from the file to hinder later inspection. The package impersonates @tailwindcss/container-queries by copying its README verbatim and pointing the repository field at tailwindlabs/tailwindcss-container-queries. The on-chain C2 pointer lets the operator rotate destination IPs by publishing new Ethereum transactions, so the fetched code is fully attacker-controlled.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-container-queries"},"versions":["0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"8e9c77f0cdfd5a3de18c77660ff7fcd1b46fd323f3b444602ae81d76c09dec5b","tlsh":"c6325db4b3d332d07f2ca44219de6b0471af6dce2060738e8d465eea1445e63643d628"}],"package_integrity":[{"filename":"tailwind-container-queries-0.1.1.tgz","hashes":{"sha1":"056416840cc0354e7541290733facfe4d2dc0e7b","sha512_sri":"sha512-hHvL1BWlIAYVfAjuPLBrCumc35ndwMAGVx/a0bK6wD5PmZdfNcjBDZxXIkLq/DRi8zRYqGgNbQNZMoKmcZHG8A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-container-queries/v/0.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019447","import_time":"2026-09-04T04:21:20.64925723Z","modified_time":"2026-09-04T03:45:02Z","sha256":"c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f","source":"amazon-inspector","versions":["0.1.1"]}]}}