MAL-2026-15912

    Dashboard / Malicious Package / MAL-2026-15912

    MAL-2026-15912

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in tailwind-aspect (npm)

    Details: Source: amazon-inspector (e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf) The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js, writes it to./inout.js, and require()s it every time a consumer imports the package. The fetched content is unpinned, unverified, and served over cleartext HTTP, giving the operator of that IP (and any on-path attacker) arbitrary code execution on the installer's machine at import time. The package name and repository metadata impersonate the official @tailwindcss/aspect-ratio plugin (repository points at tailwindlabs/tailwindcss-aspect-ratio), providing cover for the loader; the remote fetch has no relationship to any Tailwind plugin functionality.

    References: https://www.npmjs.com/package/tailwind-aspect/v/0.4.2

    Affected packages

    Package

    Name: tailwind-aspect

    Purl: pkg:npm/tailwind-aspect

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.4.2