MAL-2026-15634

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-minanimated/MAL-2026-15634.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15634
Published
2026-08-31T18:02:09Z
Modified
2026-08-31T18:31:24.241561877Z
Summary
Malicious code in tailwind-minanimated (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2)

src/index.js appends a hidden payload after ~9KB of whitespace padding that decodes and runs via eval(atob(...)) whenever the package is required (the README instructs users to require('tailwind-minanimated') from tailwind.config.js). The payload queries the Ethereum Blockscout API (https://eth.blockscout.com/api) for the latest transaction from hardcoded sender address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the destination address into two IPv4 addresses, fetches second-stage JavaScript from those hosts at paths /0x/cls and /0x/ls, XOR-decrypts the response with hardcoded keys, and executes the result via eval and a detached spawn('node', ['-e', code], {detached:true, stdio:'ignore'}).unref(). The blockchain-based C2 resolution allows the attacker to rotate infrastructure without republishing the package. The tailwind plugin functionality is a cover for the loader.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019302",
            "sha256": "78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2",
            "source": "amazon-inspector",
            "import_time": "2026-08-31T18:22:29.396091254Z",
            "versions": [
                "2.3.7"
            ],
            "modified_time": "2026-08-31T18:02:09Z"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-minanimated

Package

Name
tailwind-minanimated
View open source insights on deps.dev
Purl
pkg:npm/tailwind-minanimated

Affected ranges

Affected versions

2.*
2.3.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tailwind-minanimated-2.3.7.tgz",
            "hashes": {
                "sha1": "b4eaed915abdbfe526427daa6e3764ebd2a56b04",
                "sha512_sri": "sha512-mknRRvwBoEVdd8NMsTopFb1t7Qq+XYSyJMLN4F+jpsjd1M1P5Se5tbyHie9zOfMT/HbDdizUJtGv2lwwHCQZxw=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d3226db1f7c121541e3ed80617a55dc0622798bd347086457a6d0fde4b48ef848bfa9c",
            "path": "src/index.js",
            "sha256": "f4fadadf16b9d472c09323317a70b4872d86c675603277b3ec06b68c49e21474"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-minanimated/MAL-2026-15634.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]