MAL-2026-12222

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-opentype/MAL-2026-12222.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12222
Published
2026-08-05T09:05:34Z
Modified
2026-08-05T10:06:31.399995936Z
Summary
Malicious code in tailwind-opentype (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb)

dist/index.js re-exports a benign Tailwind plugin and appends an eval(atob(...)) payload that runs when the module is required (e.g. from a project's tailwind.config). The decoded payload uses \u-escaped module names to require('http'), require('https'), and require('child_process'), then queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com) for transactions from a hardcoded attacker address (0xa322E5f3D311D3080e6f01210633e9aDC2490Ef1). The transaction's to field is decoded into a pair of C2 IPs, from which an XOR-encoded stage-2 payload is fetched over HTTP at /0x/cls and /0x/ls with an x-payload-b64 header, and executed both via eval() and via a detached spawn('node', ['-e',...]).unref(). Every network destination, module name, and identifier is stored as \u-escaped sequences and the outer payload is base64-wrapped in eval(atob()) to defeat static review. Loading the module yields full remote code execution on the build host with attacker-controlled, on-chain-resolved payloads.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:23.756044183Z",
            "versions": [
                "1.2.3"
            ],
            "modified_time": "2026-08-05T09:05:34Z",
            "source": "amazon-inspector",
            "sha256": "bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb",
            "id": "IN-MAL-2026-014541"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-opentype

Package

Name
tailwind-opentype
View open source insights on deps.dev
Purl
pkg:npm/tailwind-opentype

Affected ranges

Affected versions

1.*
1.2.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "2276c63ed2b216aefe4050393abffe4fba5145f4",
                "sha512_sri": "sha512-F9CbTj4d4nqpJgDHnIkQQza9/8KK0KBXGF1v30nWCrb6hP+X2F2Q8IaTMEvq7S9OUgcQbDMzf+h0aQ2u2gbvXw=="
            },
            "filename": "tailwind-opentype-1.2.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "18ddf24b869d879993117aa93e6ba7d959642f5e7b58b1ef07c90d41b4dc2be5",
            "tlsh": "e7323dea5692ba87cf1b5926fd87570e233104b232ad6f254443dd76b388c8634ad60f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-opentype/MAL-2026-12222.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]