MAL-2026-4452

    Dashboard / Malicious Package / MAL-2026-4452

    MAL-2026-4452

    Published: 20 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in @tailwind-core/webpack (npm)

    Details: Source: amazon-inspector (7955094460738dc65288f88a3bb990c7d3ff52ed3683f11265b7072bd80aa4e3) Package `@tailwind-core/webpack` impersonates the legitimate Tailwind v4 webpack loader `@tailwindcss/webpack`. The README copies Tailwind Labs branding by linking logo assets at `raw.githubusercontent.com/tailwindlabs/tailwind-core/HEAD/.github/logo-light.svg` and claims a `tailwind-core.com` homepage, while the actual repo is `QaLemos/tailwind-core` (not Tailwind Labs). The loader code itself is a faithful copy of the upstream loader and performs no direct network or credential activity, but `package.json` pins three sibling typosquats as dependencies (`[email protected]`, `@tailwind-core/[email protected]`, `@tailwind-core/[email protected]`), all sharing the same impersonated namespace and identical version. Installing this package transitively pulls those sibling packages into the installer's dependency tree, which is the namespace-abuse delivery vector — the lure looks like the official Tailwind v4 webpack loader and silently brings attacker-controlled siblings along.

    References: https://www.npmjs.com/package/@tailwind-core/webpack/v/4.3.0

    Affected packages

    Package

    Name: @tailwind-core/webpack

    Purl: pkg:npm/%40tailwind-core%2Fwebpack

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.3.0
    MAL-2026-4452 | CVE-DB