{"id":"MAL-2026-15635","summary":"Malicious code in tailwind-modernanimation (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce)\nThe package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an `eval(atob('...'))` call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's `to` field, fetches JavaScript over plain HTTP from `http://\u003cip\u003e:443/0x/cls` and `http://\u003cip\u003e:443/0x/ls`, and executes it via `spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref()`. The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.\n","modified":"2026-08-31T18:31:27.211102998Z","published":"2026-08-31T18:01:37Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-31T18:22:29.299750615Z","modified_time":"2026-08-31T18:01:37Z","sha256":"05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce","source":"amazon-inspector","versions":["2.3.8"],"id":"IN-MAL-2026-019299"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-modernanimation/v/2.3.8"}],"affected":[{"package":{"name":"tailwind-modernanimation","ecosystem":"npm","purl":"pkg:npm/tailwind-modernanimation"},"versions":["2.3.8"],"database_specific":{"indicators":{"package_integrity":[{"filename":"tailwind-modernanimation-2.3.8.tgz","hashes":{"sha1":"d0e2bc047aaefcf2a7bfcb39408122ec624d4b28","sha512_sri":"sha512-nNx+3Oj4BvEDfnviHhWkel/F3EDwFA3bhpzwII83oM6CINJzAHEdgZoz32XWXz4yx9O0QilGhzr2mSJDCPH83A=="}}],"evidence_files":[{"sha256":"5d7fc58913c50f877f49d6483db570ad1bcff0d71765d379b7fb43b58c021530","tlsh":"28226db1f7c121581e3ed80617a55dc0a22798bd347086457a6e0fde4b88ef848bfa9c","path":"src/index.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-modernanimation/MAL-2026-15635.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}