MAL-2026-12219

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animationgroup/MAL-2026-12219.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12219
Published
2026-08-05T09:05:06Z
Modified
2026-08-05T10:06:29.434450926Z
Summary
Malicious code in tailwind-animationgroup (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66)

src/index.js appends an eval(atob(...)) blob after the tailwind plugin export. On any require()/import of the package, the decoded loader queries Ethereum RPC and blockscout endpoints for the latest transaction from a hardcoded address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), derives two IPv4 C2 endpoints from bytes of that transaction, and issues HTTP requests to http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The responses carry an XOR-encoded payload in an x-payload-b64 header; one payload is eval'd in-process and the other is executed via childprocess.spawn('node', ['-e', <code>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(). Strings such as 'childprocess', 'http', 'https', 'GET', 'HEAD', 'spawn', and the endpoint paths are hidden with \uXXXX unicode escapes and layered base64 wrapping. The Tailwind animation plugin surface is a decoy; the C2 address rotates via on-chain lookups, so the delivered second-stage is arbitrary and mutable.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:05:06Z",
            "id": "IN-MAL-2026-014538",
            "import_time": "2026-08-05T09:28:23.484956016Z",
            "versions": [
                "2.3.7"
            ],
            "source": "amazon-inspector",
            "sha256": "aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-animationgroup

Package

Name
tailwind-animationgroup
View open source insights on deps.dev
Purl
pkg:npm/tailwind-animationgroup

Affected ranges

Affected versions

2.*
2.3.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-R3bJRORmQnOhQJ2Ge/5tsdh9UzhwevoW5Dno9NLJ74sBB3ijdrW0Zcva7PvmIwYBphDBFbDqy73Jf6k++H84XQ==",
                "sha1": "9c8ec6c7959a494c7e26fdd65787285985f51b6a"
            },
            "filename": "tailwind-animationgroup-2.3.7.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "src/index.js",
            "tlsh": "36421be64a91ba4bdf1b5926fd87170e233104b2329d6f25704f9c76b388c86349da1f",
            "sha256": "8e4cfe4d8abd101827d6ccafe0e106caf31b5faeea46d4eb532a607b47436c59"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animationgroup/MAL-2026-12219.json"