MAL-2026-15904

    Dashboard / Malicious Package / MAL-2026-15904

    MAL-2026-15904

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in tailwind-scrollbar-styles (npm)

    Details: Source: amazon-inspector (2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada) dist/index.js exports a small tailwind plugin and then runs eval(atob("Z2x...")) on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints (1rpc.io/eth, drpc.org, publicnode, blastapi.io) and Blockscout for the most recent transaction sent by hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes four bytes of that transaction's `to` field into an IPv4 address, HTTP-GETs http://<decoded-ip>:443/0x/cls and http://<decoded-ip>:443/0x/ls, XOR-decodes the response with literal keys, and executes it via eval() and via a detached `spawn("node", ["-e",...], {detached:true, stdio:"ignore", windowsHide:true}).unref()`. After first execution the loader reads its own file, locates the `eval(atob("Z2x...` region, and rewrites dist/index.js with the region removed, so the malicious line disappears from disk. The Ethereum-transaction-based resolver lets the operator rotate the C2 IP at any time by publishing a new transaction from the controlling address, and the self-erasing stub defeats post-incident inspection of the installed copy.

    References: https://www.npmjs.com/package/tailwind-scrollbar-styles/v/4.0.3

    Affected packages

    Package

    Name: tailwind-scrollbar-styles

    Purl: pkg:npm/tailwind-scrollbar-styles

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.0.3