{"id":"MAL-2026-15903","summary":"Malicious code in tailwind-container-queries (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f)\nOn require of the package main, an appended eval(atob(...)) block in dist/index.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth) for the last transaction sent from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes the tx.to field into two IPv4 addresses. It fetches XOR-encrypted payloads from http://\u003cresolved-ip\u003e:443/0x/cls and http://\u003cresolved-ip\u003e:443/0x/ls, decrypts them with hardcoded keys, eval's the first payload in-process, and launches the second via spawn('node', ['-e', \u003cdecoded\u003e], {detached:true, stdio:'ignore', windowsHide:true}).unref() to leave a persistent detached Node process on the host. After execution the loader rewrites dist/index.js on disk to strip the eval block, removing the payload from the file to hinder later inspection. The package impersonates @tailwindcss/container-queries by copying its README verbatim and pointing the repository field at tailwindlabs/tailwindcss-container-queries. The on-chain C2 pointer lets the operator rotate destination IPs by publishing new Ethereum transactions, so the fetched code is fully attacker-controlled.\n","modified":"2026-09-04T04:30:05.842731291Z","published":"2026-09-04T03:45:02Z","database_specific":{"malicious-packages-origins":[{"versions":["0.1.1"],"id":"IN-MAL-2026-019447","import_time":"2026-09-04T04:21:20.64925723Z","modified_time":"2026-09-04T03:45:02Z","sha256":"c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-container-queries/v/0.1.1"}],"affected":[{"package":{"name":"tailwind-container-queries","ecosystem":"npm","purl":"pkg:npm/tailwind-container-queries"},"versions":["0.1.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"8e9c77f0cdfd5a3de18c77660ff7fcd1b46fd323f3b444602ae81d76c09dec5b","tlsh":"c6325db4b3d332d07f2ca44219de6b0471af6dce2060738e8d465eea1445e63643d628"}],"package_integrity":[{"filename":"tailwind-container-queries-0.1.1.tgz","hashes":{"sha1":"056416840cc0354e7541290733facfe4d2dc0e7b","sha512_sri":"sha512-hHvL1BWlIAYVfAjuPLBrCumc35ndwMAGVx/a0bK6wD5PmZdfNcjBDZxXIkLq/DRi8zRYqGgNbQNZMoKmcZHG8A=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-container-queries/MAL-2026-15903.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}