MAL-2026-12217

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animate-plugin/MAL-2026-12217.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12217
Published
2026-08-05T09:04:44Z
Modified
2026-08-05T10:06:28.902012843Z
Summary
Malicious code in tailwind-animate-plugin (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7eb20d422c7053793a78e3d898bef2d97269318be88f147d60c7d036d2d23144)

index.js appends a large base64-encoded, unicode-escaped payload after ~11 KB of whitespace padding, executed via eval(atob('...')) whenever the package is required (main = index.js). The decoded payload queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for transactions from 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from a tx.to field, then HTTP-GETs http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, XOR-decrypts the response, and executes the resulting code via spawn('node', ['-e', payload], {detached: true, stdio: 'ignore', windowsHide: true}).unref(). Sensitive identifiers ('http', 'child_process', 'spawn', 'POST', 'HEAD', 'x-payload-b64', RPC URLs, target address) are stored as \uXXXX escapes to defeat casual scanning. The package presents itself as a Tailwind CSS animation plugin; the dropper is hidden behind the benign plugin body. Any consumer of this package receives arbitrary attacker-controlled code execution on the host at require time, with the C2 host resolvable on-chain and thus resistant to takedown.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:23.231028421Z",
            "sha256": "7eb20d422c7053793a78e3d898bef2d97269318be88f147d60c7d036d2d23144",
            "modified_time": "2026-08-05T09:04:44Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014535",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-animate-plugin

Package

Name
tailwind-animate-plugin
View open source insights on deps.dev
Purl
pkg:npm/tailwind-animate-plugin

Affected ranges

Affected versions

1.*
1.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animate-plugin/MAL-2026-12217.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "b269c93d22ca67aa134c1f47d798446d45a7ab53be4152ca86e89a9bfdde3df3",
            "path": "index.js",
            "tlsh": "31726fe2969a7647cf035526fe6f07ce1b3904b176ac1fa97013987223c9c5826ad31f"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-animate-plugin-1.1.0.tgz",
            "hashes": {
                "sha1": "e7e3e97f964cceac95a72ce2d331e2f829839872",
                "sha512_sri": "sha512-Rr+TfwHdkbFFgUd74ggcM6k0iKEPaqxhGfxK7f7KrFc8rYJ/GE9c9SsNQGZzQkHP4S8uKB/2JanIxQdlv/r2iw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]