MAL-2026-14118
Malicious code in core-tailwindcss-utility (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83) Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin() which fetches JSON from the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108 and passes the response's `credits` field to `new Function(...)` with `require`, `process`, and `Buffer` bound in scope, executing the returned string as Node.js code on the caller's host. A decoy setDefaultModule() constructs cdnjs.<provider> URLs (cloudflare.com, fastly.net, etc.) to disguise the module as a font-awesome/CDN helper, but the actually-invoked path targets the bare-IP C2. Declared dependencies (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3, node-machine-id, socket.io-client, axios) are inconsistent with the stated Tailwind purpose and pre-stage the second-stage payload with primitives for browser credential decryption and remote C2, which the fetched code can load via the bound require.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for core-tailwindcss-utility (npm). Pin to a known-safe version or switch to an alternative.