MAL-2026-14038

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-toolkit/MAL-2026-14038.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14038
Published
2026-08-14T14:10:32Z
Modified
2026-08-14T14:46:36.998975775Z
Summary
Malicious code in tailwind-toolkit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (afeb355b3088d1c03dbbb5a60c1afea5afbe3a384f50417ae6cfa7340d8c072d)

The package presents itself as a Tailwind CSS plugin, but its default export (which runs when users register it in tailwind.config) issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/109 and passes the response body's credits field into new Function(require, module, exports,...) for execution in the installer's Node process. The destination URL is assembled from split variables and disguised with CDN/icon vocabulary (an unused iconDomain map referencing cloudflare/fastly/akamai, a bearrtoken: "logo" header, a response field named credits), while the actual host is an unrelated bare IP on a non-standard port. The package also declares dependencies on @primno/dpapi (Windows DPAPI credential decryption), better-sqlite3/sqlite3 (browser cookie and Login Data databases), and node-machine-id, indicating the retrieved payload is a browser-credential stealer. The remote host and executed bytes are fully attacker-controlled and unrelated to the advertised Tailwind CSS purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017750",
            "import_time": "2026-08-14T14:28:05.716642398Z",
            "sha256": "afeb355b3088d1c03dbbb5a60c1afea5afbe3a384f50417ae6cfa7340d8c072d",
            "versions": [
                "1.3.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:10:32Z"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-toolkit

Package

Name
tailwind-toolkit
View open source insights on deps.dev
Purl
pkg:npm/tailwind-toolkit

Affected ranges

Affected versions

1.*
1.3.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "e8c1716546fa31a36a63e0edf30f10027165e313375de931f48e42902fca568e5f24e8",
            "sha256": "52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-toolkit-1.3.2.tgz",
            "hashes": {
                "sha1": "5b85c9d63ca8c9b9d0fd1fc53c3f4dee027b3005",
                "sha512_sri": "sha512-C2rwhc4qxSBW6PEfKH1bpYmSNvhFehX3lfHfmKUVKg3vpJ3WWjjrsZ8WPOW5YWjeL4gCcAg9gE4YA+Mc/y88mw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-toolkit/MAL-2026-14038.json"