{"id":"MAL-2025-191593","summary":"Malicious code in tailwind-state (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6a38d486faa9b2c50df466ad3d25dfa289548864c0fde19ad24d7da6421db683)\nThe package tailwind-state was found to contain malicious code.\n","aliases":["SNYK-JS-TAILWINDSTATE-14152320"],"modified":"2026-03-19T12:48:37.671642Z","published":"2025-12-01T13:26:43Z","database_specific":{"malicious-packages-origins":[{"sha256":"5e671748e7d42fab74c13b0a53a365a668e732f63ea4ae54b8bf31c2567d40a5","source":"reversing-labs","versions":["1.0.3"],"id":"RLMA-2025-05959","import_time":"2025-12-02T09:09:54.952585114Z","modified_time":"2025-12-01T13:26:43Z"},{"source":"amazon-inspector","versions":["1.0.3"],"import_time":"2025-12-02T21:35:55.682191699Z","modified_time":"2025-12-02T21:11:00Z","sha256":"6a38d486faa9b2c50df466ad3d25dfa289548864c0fde19ad24d7da6421db683"},{"sha256":"299ea83f5e351b1ef1cc9dcafbf99ebf9a3aac57d8f2ee800de6f4ddfc7814ab","source":"reversing-labs","id":"RLUA-2025-06509","import_time":"2025-12-24T10:07:35.75780256Z","modified_time":"2025-12-23T08:32:19Z"},{"modified_time":"2026-03-18T13:11:41Z","sha256":"465e0e996999a2910c579cf861c1ea4bf6508fe20e5c65782f7379d011ac4ce7","source":"reversing-labs","id":"RLUA-2026-01605","import_time":"2026-03-19T12:21:01.130540307Z"}]},"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-TAILWINDSTATE-14152320"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"}],"affected":[{"package":{"name":"tailwind-state","ecosystem":"npm","purl":"pkg:npm/tailwind-state"},"versions":["1.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-state/MAL-2025-191593.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}