MAL-2026-14118
Dashboard / Malicious Package / MAL-2026-14118
MAL-2026-14118
Summary: Malicious code in core-tailwindcss-utility (npm)
Details: Source: amazon-inspector (67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83) Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin() which fetches JSON from the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108 and passes the response's `credits` field to `new Function(...)` with `require`, `process`, and `Buffer` bound in scope, executing the returned string as Node.js code on the caller's host. A decoy setDefaultModule() constructs cdnjs.<provider> URLs (cloudflare.com, fastly.net, etc.) to disguise the module as a font-awesome/CDN helper, but the actually-invoked path targets the bare-IP C2. Declared dependencies (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3, node-machine-id, socket.io-client, axios) are inconsistent with the stated Tailwind purpose and pre-stage the second-stage payload with primitives for browser credential decryption and remote C2, which the fetched code can load via the bound require.
Affected packages
Package
Name: core-tailwindcss-utility
Purl: pkg:npm/core-tailwindcss-utility
Affected ranges
Type: N/A
Events:
