MAL-2026-12218
Dashboard / Malicious Package / MAL-2026-12218
MAL-2026-12218
Summary: Malicious code in tailwind-animation-founder (npm)
Details: Source: amazon-inspector (212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21) The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream ('tailwindcss-animationfound'), indicating a typosquat identity. src/index.js appends an obfuscated IIFE after a legitimate-looking Tailwind plugin export. The trailing block pulls http, https, and child_process.spawn into globals, uses a length-based string-shuffle routine to reconstruct the identifier 'constructor', instantiates a Function from a shuffle-decoded source blob, and immediately invokes it. The executable payload is only readable after runtime decoding, so the plugin performs opaque code execution the moment a build tool runs require('tailwind-animation-founder'). The combination of obfuscation, networking primitives (http/https), process-spawn capability, and Function-constructor evaluation on the main entry is the shape of a dropper/stealer, not a Tailwind utility plugin.
Affected packages
Package
Name: tailwind-animation-founder
Purl: pkg:npm/tailwind-animation-founder
Affected ranges
Type: N/A
Events:
