MAL-2026-12220

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animationpack/MAL-2026-12220.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12220
Published
2026-08-05T09:05:16Z
Modified
2026-08-05T10:06:30.159556598Z
Summary
Malicious code in tailwind-animationpack (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3)

src/index.js appends an obfuscated eval(atob(...)) block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and constants behind \uXXXX escapes, queries Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's to field into two IPv4 addresses, fetches an XOR-encoded second-stage payload from those hosts, then runs it via eval() and a detached spawn('node', ['-e', payload], {detached:true, stdio:'ignore', windowsHide:true}).unref(). The loader executes whenever a consumer require()s the package, giving the operator of the referenced Ethereum address arbitrary code execution on the installer's machine with a detached child process that survives the parent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:05:16Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014539",
            "import_time": "2026-08-05T09:28:23.573767673Z",
            "sha256": "63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3",
            "versions": [
                "2.3.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-animationpack

Package

Name
tailwind-animationpack
View open source insights on deps.dev
Purl
pkg:npm/tailwind-animationpack

Affected ranges

Affected versions

2.*
2.3.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tailwind-animationpack-2.3.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-9bOr9dPhJorDFovCRHic9wm5vAGVHFYa6LKAaIl5I+55MpkPRyF86cFOf+9nfdiTZ0BIRUjgOCl80y6pySN/nQ==",
                "sha1": "4bd31b6aa6478208248ee28f87088f8dccc8f251"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "36421be64a91ba4bdf1b5926fd87170e233104b2329d6f25704f9c76b388c86349da1f",
            "sha256": "8e4cfe4d8abd101827d6ccafe0e106caf31b5faeea46d4eb532a607b47436c59",
            "path": "src/index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-animationpack/MAL-2026-12220.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]