MAL-2026-15826

    Dashboard / Malicious Package / MAL-2026-15826

    MAL-2026-15826

    Published: 2 Sept 2026Last Modified: 2 Sept 2026

    Summary: Malicious code in tailwindcss-fluid-styles (npm)

    Details: Source: amazon-inspector (4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631) src/index.js executes an eval(atob(...)) blob at top level on require(). The decoded loader queries Ethereum RPC endpoints for the latest transaction from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes that transaction's `to` field into two IPv4 addresses used as C2 hosts. It fetches XOR-encrypted payloads from paths /0x/cls and /0x/ls on those hosts, eval()s the first, and spawns `node -e <payload>` with `{detached:true, stdio:'ignore', windowsHide:true}` and.unref() to run the second as a persistent hidden background process on the installer's host. Immediately after execution the module reads its own source, locates the eval(atob("Z2x...")) region and rewrites __filename on disk to remove it, leaving a benign-looking tailwind plugin after first import. The package presents itself as a Tailwind CSS fluid-styles plugin; the attacker-controlled code, blockchain-based C2 resolution, self-erasing loader and detached implant have no relationship to that stated purpose.

    References: https://www.npmjs.com/package/tailwindcss-fluid-styles/v/2.0.7

    Affected packages

    Package

    Name: tailwindcss-fluid-styles

    Purl: pkg:npm/tailwindcss-fluid-styles

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.7