MAL-2026-4451

    Dashboard / Malicious Package / MAL-2026-4451

    MAL-2026-4451

    Published: 19 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in @tailwind-core/vite (npm)

    Details: Source: amazon-inspector (1f9a00740b85c3ce7b36a9ba242f3eccc9ebf3d4f626ab911342c50d63b48805) The package name @tailwind-core/vite impersonates the official @tailwindcss/vite plugin from tailwindlabs, and its package.json declares three dependencies — @tailwind-core/[email protected], [email protected], and @tailwind-core/[email protected] — that mirror the official @tailwindcss/node, tailwindcss, and @tailwindcss/oxide packages. The README copies Tailwind branding, including a logo srcset pointing at tailwindlabs/tailwind-core, but the repository is owned by an unrelated account (QaLemos), not tailwindlabs. While dist/index.mjs in this tarball appears to be a copy of the legitimate Tailwind Vite plugin with no overt payload, installing this package silently pulls in three sibling typosquatted packages under the same attacker-controlled namespace. A developer who mistypes the official scope and runs `npm install @tailwind-core/vite` ends up with attacker-controlled code from the sibling packages in their dependency tree.

    References: https://www.npmjs.com/package/@tailwind-core/vite/v/4.3.0

    Affected packages

    Package

    Name: @tailwind-core/vite

    Purl: pkg:npm/%40tailwind-core%2Fvite

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.3.0
    MAL-2026-4451 | CVE-DB