MAL-2026-14037
Malicious code in tailwind-plugin-kit (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af) The package presents itself as a Tailwind CSS plugin toolkit but its exported `getPlugin` function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109) and passes the response's `data.credits` field to `new Function(...)` with a full Node.js execution context (require, module, exports, process, Buffer, globalThis, Promise). Any project following the README instructions and registering the package as a Tailwind plugin (`plugins: [toolkit]`) triggers execution of arbitrary attacker-controlled JavaScript on the developer/build machine. The destination URL is assembled by concatenating separate protocol/domain/path fragments, and the file also contains an unused `setDefaultModule` referencing well-known CDN hostnames (cloudflare, fastly, akamai, cloudfront) as a decoy — the actual network destination is the bare IP, not any CDN. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a second-stage infostealer payload targeting browser credential stores and machine identifiers on the loaded host.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-plugin-kit (npm). Pin to a known-safe version or switch to an alternative.