MAL-2026-16056

    Dashboard / Malicious Package / MAL-2026-16056

    MAL-2026-16056

    Published: 8 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in tailwind-aspect-styles (npm)

    Details: Source: amazon-inspector (4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14) The package's main module (src/index.js) performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in the consumer's working directory, and immediately require()s the written file. The fetch is unpinned, unauthenticated, and served from a bare IP over cleartext, so the operator of that endpoint controls arbitrary JavaScript executed in the Node process that loads this package. The package presents itself as the Tailwind aspect-ratio plugin, with a package.json repository field pointing to tailwindlabs/tailwindcss-aspect-ratio, while the dropper is appended after the legitimate-looking plugin export.

    References: https://www.npmjs.com/package/tailwind-aspect-styles/v/0.4.2

    Affected packages

    Package

    Name: tailwind-aspect-styles

    Purl: pkg:npm/tailwind-aspect-styles

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.4.2