MAL-2026-12218
Malicious code in tailwind-animation-founder (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21) The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream ('tailwindcss-animationfound'), indicating a typosquat identity. src/index.js appends an obfuscated IIFE after a legitimate-looking Tailwind plugin export. The trailing block pulls http, https, and child_process.spawn into globals, uses a length-based string-shuffle routine to reconstruct the identifier 'constructor', instantiates a Function from a shuffle-decoded source blob, and immediately invokes it. The executable payload is only readable after runtime decoding, so the plugin performs opaque code execution the moment a build tool runs require('tailwind-animation-founder'). The combination of obfuscation, networking primitives (http/https), process-spawn capability, and Function-constructor evaluation on the main entry is the shape of a dropper/stealer, not a Tailwind utility plugin.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-animation-founder (npm). Pin to a known-safe version or switch to an alternative.