{"id":"MAL-2026-14190","summary":"Malicious code in tailwind-utility-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff)\nThe package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to https://31.97.137.157:45000/icons/109, fetches JSON from that endpoint, and passes the response's `credits` field to `new Function('require','module',...,'Promise', data.credits)`, invoking it with `require`, `process`, and `Buffer`. This is arbitrary attacker-controlled code execution on the host that loads the package, with full Node privileges. A decoy `setDefaultModule` referencing CDN-lookalike domains and a Font Awesome icon path is present as cover-story metadata, and the fragmented URL assembly conceals the bare-IP destination. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a browser-credential-stealer payload delivered via the remote loader.\n","modified":"2026-08-19T00:30:16.005849067Z","published":"2026-08-19T00:00:24Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.3.2"],"id":"IN-MAL-2026-018258","import_time":"2026-08-19T00:21:14.056983183Z","modified_time":"2026-08-19T00:00:24Z","sha256":"39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-utility-kit/v/1.3.2"}],"affected":[{"package":{"name":"tailwind-utility-kit","ecosystem":"npm","purl":"pkg:npm/tailwind-utility-kit"},"versions":["1.3.2"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"e8c1716546fa31a36a63e0edf30f10027165e313375de931f48e42902fca568e5f24e8","path":"index.js","sha256":"52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9"}],"package_integrity":[{"filename":"tailwind-utility-kit-1.3.2.tgz","hashes":{"sha512_sri":"sha512-R5SWbFwVYjhvMIBIF9I3g4MdN8S7jFtOP4N0HsYd6t+inppbWWw4vIQ7JjBsusdR9+ADWUR0V2bvNCwfVY9yCw==","sha1":"c11bc2fa7e86ab39d285c4ca84e1d7f0aecb593c"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-utility-kit/MAL-2026-14190.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}