tailwind-color-shades

{"modified":"2026-06-25T18:43:49Z","published":"2026-06-25T18:43:49Z","schema_version":"1.7.4","id":"MAL-2026-6471","summary":"Malicious code in tailwind-color-shades (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dfd681005962f5628f4394450bae9430992e58159e3256bb4af2bc156c5c1fc5)\nThe package's documented entry point `index.ts` begins with `import './src/bootstrap';`, which causes `src/bootstrap.js` to run whenever the module is required or imported. `src/bootstrap.js` is a custom string-shuffle obfuscator: a function `YWG(x)` deterministically unscrambles opaque string literals (e.g. `YWG('axhscuutcrogycrneotisjlnkdpfqmzovtrwb').substr(0,11)` reconstructs the literal `'constructor'`), then uses `Function.prototype.constructor` to build a `Function` from one shuffled blob, executes it on a second shuffled blob, and invokes the result via `XZs(7942)`. Before invoking the constructed code the bootstrap explicitly re-exposes Node capabilities to it via `global['r']=require; global['m']=module;`, granting the dynamically generated payload full filesystem, child_process, and network access. The package's advertised purpose is straightforward Tailwind color-shade math — a few dozen lines of pure arithmetic — so a hand-rolled string-shuffle obfuscator wrapping `Function`-constructed code at import time has no legitimate purpose. This is the standard supply-chain attack shape: opaque payload, evasion-only obfuscation, automatic execution on consumer import, full Node capability re-export.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-color-shades"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/bootstrap.js","sha256":"8c031bc55a321bae573f52f953e383c949b57225cc004d1f3c15300f770c0af3","tlsh":"26815cc43148fdc978c042b081cb919f2c6506e2d87fb1c4888e86ea65422465eb9aff"}],"package_integrity":[{"filename":"tailwind-color-shades-1.0.2.tgz","hashes":{"sha1":"20d89e126abc68e74e01f1a8701b68dfc29005fa","sha512_sri":"sha512-JifrB2+zxDatB0NU3qm7yKN925z9kuwoM1gakcPkYpgtnbEJ27JHW3OnomJmdpO/sFeZ6Aer0OsYJ4HxhHSepA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-color-shades/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007531","import_time":"2026-06-25T19:13:49.596882938Z","modified_time":"2026-06-25T18:43:49Z","sha256":"dfd681005962f5628f4394450bae9430992e58159e3256bb4af2bc156c5c1fc5","source":"amazon-inspector","versions":["1.0.2"]}]}}