MAL-2026-15634
Malicious code in tailwind-minanimated (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2) src/index.js appends a hidden payload after ~9KB of whitespace padding that decodes and runs via eval(atob(...)) whenever the package is required (the README instructs users to require('tailwind-minanimated') from tailwind.config.js). The payload queries the Ethereum Blockscout API (https://eth.blockscout.com/api) for the latest transaction from hardcoded sender address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the destination address into two IPv4 addresses, fetches second-stage JavaScript from those hosts at paths /0x/cls and /0x/ls, XOR-decrypts the response with hardcoded keys, and executes the result via eval and a detached spawn('node', ['-e', code], {detached:true, stdio:'ignore'}).unref(). The blockchain-based C2 resolution allows the attacker to rotate infrastructure without republishing the package. The tailwind plugin functionality is a cover for the loader.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-minanimated (npm). Pin to a known-safe version or switch to an alternative.