MAL-2026-15634

    Dashboard / Malicious Package / MAL-2026-15634

    MAL-2026-15634

    Published: 31 Aug 2026Last Modified: 31 Aug 2026

    Summary: Malicious code in tailwind-minanimated (npm)

    Details: Source: amazon-inspector (78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2) src/index.js appends a hidden payload after ~9KB of whitespace padding that decodes and runs via eval(atob(...)) whenever the package is required (the README instructs users to require('tailwind-minanimated') from tailwind.config.js). The payload queries the Ethereum Blockscout API (https://eth.blockscout.com/api) for the latest transaction from hardcoded sender address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the destination address into two IPv4 addresses, fetches second-stage JavaScript from those hosts at paths /0x/cls and /0x/ls, XOR-decrypts the response with hardcoded keys, and executes the result via eval and a detached spawn('node', ['-e', code], {detached:true, stdio:'ignore'}).unref(). The blockchain-based C2 resolution allows the attacker to rotate infrastructure without republishing the package. The tailwind plugin functionality is a cover for the loader.

    References: https://www.npmjs.com/package/tailwind-minanimated/v/2.3.7

    Affected packages

    Package

    Name: tailwind-minanimated

    Purl: pkg:npm/tailwind-minanimated

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.3.7