{"id":"MAL-2026-14037","summary":"Malicious code in tailwind-plugin-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af)\nThe package presents itself as a Tailwind CSS plugin toolkit but its exported `getPlugin` function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109) and passes the response's `data.credits` field to `new Function(...)` with a full Node.js execution context (require, module, exports, process, Buffer, globalThis, Promise). Any project following the README instructions and registering the package as a Tailwind plugin (`plugins: [toolkit]`) triggers execution of arbitrary attacker-controlled JavaScript on the developer/build machine. The destination URL is assembled by concatenating separate protocol/domain/path fragments, and the file also contains an unused `setDefaultModule` referencing well-known CDN hostnames (cloudflare, fastly, akamai, cloudfront) as a decoy — the actual network destination is the bare IP, not any CDN. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a second-stage infostealer payload targeting browser credential stores and machine identifiers on the loaded host.\n","modified":"2026-08-14T14:46:37.003388692Z","published":"2026-08-14T14:11:56Z","database_specific":{"malicious-packages-origins":[{"versions":["1.3.2"],"id":"IN-MAL-2026-017759","import_time":"2026-08-14T14:28:06.642726032Z","modified_time":"2026-08-14T14:11:56Z","sha256":"3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-plugin-kit/v/1.3.2"}],"affected":[{"package":{"name":"tailwind-plugin-kit","ecosystem":"npm","purl":"pkg:npm/tailwind-plugin-kit"},"versions":["1.3.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9","tlsh":"e8c1716546fa31a36a63e0edf30f10027165e313375de931f48e42902fca568e5f24e8","path":"index.js"}],"package_integrity":[{"filename":"tailwind-plugin-kit-1.3.2.tgz","hashes":{"sha1":"dd75d7b2ab47ad17512e3743e6d81d76b843ace5","sha512_sri":"sha512-gKvtQkkbvKzmZdpgavfmrr5WOXLr6xnl/uYTNSSt047gX7JAtUSEg1M8JfX9S0Sg9NhBuQurVJVtVZYaWq0jdQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-plugin-kit/MAL-2026-14037.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}