MAL-2026-14567

Dashboard / Malicious Package / MAL-2026-14567

MAL-2026-14567

Summary: Malicious code in tailwindcss-3d-animate (npm)

Details: Source: amazon-inspector (bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c) index.js re-exports the legitimate tailwindcss-3d plugin and then appends `eval(atob("..."))` at module top level, so the payload runs on any `require('tailwindcss-3d-animate')`. The decoded blob is an obfuscator.io string-array/control-flow-flattened bundle (`_0x240a` rotation, `global['r']=require`, `global['m']=module`) that pulls in http/https/zlib/child_process and executes network-fetched code. Decoded strings reveal an Ethereum-address-as-dead-drop staging channel: Etherscan-style `?module=account&action=txlist&address=0xa322E5f3...D311D3080e...9aDC2490Ef` queries against public RPC/explorer hosts (drpc.org, eth-mainnet.publicnode, *.blockscout.com) are used to read attacker-controlled on-chain data as the next-stage URL, which is then zlib-inflated and executed via Function/eval and child_process spawn. The package name typosquats the legitimate `tailwindcss-3d` (same `sambauers/tailwindcss-3d` repo URL) and reproduces its source verbatim as cover. Source: ghsa-malware (3d1defedbeea471958124829553069330323040f99fc537a12c91f6949a752a9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-683p-54mf-9297, https://www.npmjs.com/package/tailwindcss-3d-animate/v/1.2.1, https://www.npmjs.com/package/tailwindcss-3d-animate/v/1.2.2, https://www.npmjs.com/package/tailwindcss-3d-animate/v/1.1.0, https://www.npmjs.com/package/tailwindcss-3d-animate/v/1.2.0