MAL-2026-15635
Dashboard / Malicious Package / MAL-2026-15635
MAL-2026-15635
Summary: Malicious code in tailwind-modernanimation (npm)
Details: Source: amazon-inspector (05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce) The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an `eval(atob('...'))` call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's `to` field, fetches JavaScript over plain HTTP from `http://<ip>:443/0x/cls` and `http://<ip>:443/0x/ls`, and executes it via `spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref()`. The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.
Affected packages
Package
Name: tailwind-modernanimation
Purl: pkg:npm/tailwind-modernanimation
Affected ranges
Type: N/A
Events:
