MAL-2026-14118

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-tailwindcss-utility/MAL-2026-14118.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14118
Published
2026-08-18T04:43:34Z
Modified
2026-08-18T05:02:40.993977889Z
Summary
Malicious code in core-tailwindcss-utility (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83)

Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin() which fetches JSON from the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108 and passes the response's credits field to new Function(...) with require, process, and Buffer bound in scope, executing the returned string as Node.js code on the caller's host. A decoy setDefaultModule() constructs cdnjs.<provider> URLs (cloudflare.com, fastly.net, etc.) to disguise the module as a font-awesome/CDN helper, but the actually-invoked path targets the bare-IP C2. Declared dependencies (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3, node-machine-id, socket.io-client, axios) are inconsistent with the stated Tailwind purpose and pre-stage the second-stage payload with primitives for browser credential decryption and remote C2, which the fetched code can load via the bound require.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T04:47:05.138382757Z",
            "sha256": "67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83",
            "modified_time": "2026-08-18T04:43:34Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017984",
            "versions": [
                "3.7.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / core-tailwindcss-utility

Package

Name
core-tailwindcss-utility
View open source insights on deps.dev
Purl
pkg:npm/core-tailwindcss-utility

Affected ranges

Affected versions

3.*
3.7.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-tailwindcss-utility/MAL-2026-14118.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b",
            "path": "index.js",
            "tlsh": "82c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8"
        },
        {
            "sha256": "bb7170c12c13ac45f3a725207c8ee2d59f7003ef0c206df6368902b91ebe2b17",
            "tlsh": "64014710ce11dd7305d55187786880969251990b8e41fc4d339647ae0f8e5afa1fe25d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "core-tailwindcss-utility-3.7.1.tgz",
            "hashes": {
                "sha1": "ca826cd39b332f668c1e75746240d96ad6394992",
                "sha512_sri": "sha512-wjgYcjHg42ux2ujfs9fVRwUbfvsTthx703vf7+lSVrPOWpgjDFnY5K78sr3abtT7vypqZWO0U8VP4Q8IuYSWvA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]