MAL-2026-16179

    Dashboard / Malicious Package / MAL-2026-16179

    MAL-2026-16179

    Published: 15 Sept 2026Last Modified: 15 Sept 2026

    Summary: Malicious code in process-tailwind (npm)

    Details: Source: amazon-inspector (d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432) On require/import, index.js unconditionally calls initialize(), which spawns a detached, unref'd `node loader.js` child with stdio ignored and writes a PID file. loader.js fetches JSON from https://api.npoint.io/24c25d5f5fcbb0992a4f (a mutable third-party paste endpoint), base64-decodes the `code` field, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)(...)`, granting the remote endpoint operator arbitrary code execution on the installer's host. The remote URL is stored in a constant misleadingly named `API_KEY` and surrounded by comments describing the loader as a sandboxed educational component, contradicting the actual fetch-decode-eval behavior.

    References: https://www.npmjs.com/package/process-tailwind/v/1.1.99

    Affected packages

    Package

    Name: process-tailwind

    Purl: pkg:npm/process-tailwind

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.99