MAL-2026-14037
Dashboard / Malicious Package / MAL-2026-14037
MAL-2026-14037
Summary: Malicious code in tailwind-plugin-kit (npm)
Details: Source: amazon-inspector (3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af) The package presents itself as a Tailwind CSS plugin toolkit but its exported `getPlugin` function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109) and passes the response's `data.credits` field to `new Function(...)` with a full Node.js execution context (require, module, exports, process, Buffer, globalThis, Promise). Any project following the README instructions and registering the package as a Tailwind plugin (`plugins: [toolkit]`) triggers execution of arbitrary attacker-controlled JavaScript on the developer/build machine. The destination URL is assembled by concatenating separate protocol/domain/path fragments, and the file also contains an unused `setDefaultModule` referencing well-known CDN hostnames (cloudflare, fastly, akamai, cloudfront) as a decoy — the actual network destination is the bare IP, not any CDN. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a second-stage infostealer payload targeting browser credential stores and machine identifiers on the loaded host.
Affected packages
Package
Name: tailwind-plugin-kit
Purl: pkg:npm/tailwind-plugin-kit
Affected ranges
Type: N/A
Events:
