MAL-2026-12218

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animation-founder/MAL-2026-12218.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12218
Published
2026-08-05T09:06:25Z
Modified
2026-08-05T10:06:29.129842967Z
Summary
Malicious code in tailwind-animation-founder (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21)

The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream ('tailwindcss-animationfound'), indicating a typosquat identity. src/index.js appends an obfuscated IIFE after a legitimate-looking Tailwind plugin export. The trailing block pulls http, https, and child_process.spawn into globals, uses a length-based string-shuffle routine to reconstruct the identifier 'constructor', instantiates a Function from a shuffle-decoded source blob, and immediately invokes it. The executable payload is only readable after runtime decoding, so the plugin performs opaque code execution the moment a build tool runs require('tailwind-animation-founder'). The combination of obfuscation, networking primitives (http/https), process-spawn capability, and Function-constructor evaluation on the main entry is the shape of a dropper/stealer, not a Tailwind utility plugin.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014547",
            "import_time": "2026-08-05T09:28:24.344361225Z",
            "sha256": "212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21",
            "versions": [
                "2.5.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T09:06:25Z"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-animation-founder

Package

Name
tailwind-animation-founder
View open source insights on deps.dev
Purl
pkg:npm/tailwind-animation-founder

Affected ranges

Affected versions

2.*
2.5.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animation-founder/MAL-2026-12218.json"
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "tlsh": "c0c16cb55b88ea888012b1d897cf4563d021d5652acd8471f34fd8dbcb48960b2d7df6",
            "sha256": "e9d6aa5ac88bf50a35f4c12b34664075649be0183d5d1bc4dfb46b2e880ed88a"
        },
        {
            "path": "package.json",
            "tlsh": "31212911c9589d735281769a5aba0682446780430c98fe0d73ad825c8f8d66ff2be7ee",
            "sha256": "99a6dcbbfe08a4da0b501f9c3f776b1d8ecd78d3a0fc2d9c2a35a761588d2bfa"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-animation-founder-2.5.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-owkpnk8KKb3tPrGv51kJBVYUjrvJniJmPtqMbdNREZDGSqE8ttR+XPdqBPxZ52pvEfdtilmMg6cNFlT7zdmYcQ==",
                "sha1": "ba5bb6ff57c7d988caf1397b2f328b1217b8826f"
            }
        }
    ]
}