tailwind-aspect-styles

{"modified":"2026-09-08T23:55:46Z","published":"2026-09-08T23:55:46Z","schema_version":"1.7.4","id":"MAL-2026-16056","summary":"Malicious code in tailwind-aspect-styles (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14)\nThe package's main module (src/index.js) performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in the consumer's working directory, and immediately require()s the written file. The fetch is unpinned, unauthenticated, and served from a bare IP over cleartext, so the operator of that endpoint controls arbitrary JavaScript executed in the Node process that loads this package. The package presents itself as the Tailwind aspect-ratio plugin, with a package.json repository field pointing to tailwindlabs/tailwindcss-aspect-ratio, while the dropper is appended after the legitimate-looking plugin export.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-aspect-styles"},"versions":["0.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"2675b2db17a311c8c48797fb24aaeed4d548c598f165f7a55ce5f74f76669f62","tlsh":"f43165b1068185044861769793619c42e6dbb1b4ce7e8082ead54c7947c1dd1bb12ebb"},{"path":"package.json","sha256":"d9183021b7acf6519b2b06eace5c2d8dcd7b96aa5976656ffa9a1c3544f12a81","tlsh":"12f07822ce240e7305e4716197b91597a2a318278418bc0e31c2860c8b8c5aff0f966d"}],"package_integrity":[{"filename":"tailwind-aspect-styles-0.4.2.tgz","hashes":{"sha1":"b719db600915fadcfa0802e4c102b9595c1a1eaf","sha512_sri":"sha512-r0XSNvaQ5iDpp1/L3nsVvTG4xEKMXjLWlNs0AnSvsCRAUPWdp80qDU5TpISjMsJsLlphArL40//p2zj68Zw7eQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-aspect-styles/v/0.4.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019722","import_time":"2026-09-09T00:47:57.620002484Z","modified_time":"2026-09-08T23:55:46Z","sha256":"4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14","source":"amazon-inspector","versions":["0.4.2"]}]}}