{"id":"MAL-2026-15634","summary":"Malicious code in tailwind-minanimated (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2)\nsrc/index.js appends a hidden payload after ~9KB of whitespace padding that decodes and runs via eval(atob(...)) whenever the package is required (the README instructs users to require('tailwind-minanimated') from tailwind.config.js). The payload queries the Ethereum Blockscout API (https://eth.blockscout.com/api) for the latest transaction from hardcoded sender address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the destination address into two IPv4 addresses, fetches second-stage JavaScript from those hosts at paths /0x/cls and /0x/ls, XOR-decrypts the response with hardcoded keys, and executes the result via eval and a detached spawn('node', ['-e', code], {detached:true, stdio:'ignore'}).unref(). The blockchain-based C2 resolution allows the attacker to rotate infrastructure without republishing the package. The tailwind plugin functionality is a cover for the loader.\n","modified":"2026-08-31T18:31:24.241561877Z","published":"2026-08-31T18:02:09Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019302","import_time":"2026-08-31T18:22:29.396091254Z","modified_time":"2026-08-31T18:02:09Z","sha256":"78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2","source":"amazon-inspector","versions":["2.3.7"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-minanimated/v/2.3.7"}],"affected":[{"package":{"name":"tailwind-minanimated","ecosystem":"npm","purl":"pkg:npm/tailwind-minanimated"},"versions":["2.3.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-minanimated/MAL-2026-15634.json","indicators":{"evidence_files":[{"path":"src/index.js","sha256":"f4fadadf16b9d472c09323317a70b4872d86c675603277b3ec06b68c49e21474","tlsh":"d3226db1f7c121541e3ed80617a55dc0622798bd347086457a6d0fde4b48ef848bfa9c"}],"package_integrity":[{"filename":"tailwind-minanimated-2.3.7.tgz","hashes":{"sha1":"b4eaed915abdbfe526427daa6e3764ebd2a56b04","sha512_sri":"sha512-mknRRvwBoEVdd8NMsTopFb1t7Qq+XYSyJMLN4F+jpsjd1M1P5Se5tbyHie9zOfMT/HbDdizUJtGv2lwwHCQZxw=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}