MAL-2026-14190

    Dashboard / Malicious Package / MAL-2026-14190

    MAL-2026-14190

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in tailwind-utility-kit (npm)

    Details: Source: amazon-inspector (39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff) The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to https://31.97.137.157:45000/icons/109, fetches JSON from that endpoint, and passes the response's `credits` field to `new Function('require','module',...,'Promise', data.credits)`, invoking it with `require`, `process`, and `Buffer`. This is arbitrary attacker-controlled code execution on the host that loads the package, with full Node privileges. A decoy `setDefaultModule` referencing CDN-lookalike domains and a Font Awesome icon path is present as cover-story metadata, and the fragmented URL assembly conceals the bare-IP destination. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a browser-credential-stealer payload delivered via the remote loader.

    References: https://www.npmjs.com/package/tailwind-utility-kit/v/1.3.2

    Affected packages

    Package

    Name: tailwind-utility-kit

    Purl: pkg:npm/tailwind-utility-kit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.3.2