MAL-2026-15635

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-modernanimation/MAL-2026-15635.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15635
Published
2026-08-31T18:01:37Z
Modified
2026-08-31T18:31:27.211102998Z
Summary
Malicious code in tailwind-modernanimation (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce)

The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an eval(atob('...')) call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's to field, fetches JavaScript over plain HTTP from http://<ip>:443/0x/cls and http://<ip>:443/0x/ls, and executes it via spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref(). The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-31T18:22:29.299750615Z",
            "source": "amazon-inspector",
            "versions": [
                "2.3.8"
            ],
            "id": "IN-MAL-2026-019299",
            "modified_time": "2026-08-31T18:01:37Z",
            "sha256": "05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-modernanimation

Package

Name
tailwind-modernanimation
View open source insights on deps.dev
Purl
pkg:npm/tailwind-modernanimation

Affected ranges

Affected versions

2.*
2.3.8

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-modernanimation/MAL-2026-15635.json"
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "tlsh": "28226db1f7c121581e3ed80617a55dc0a22798bd347086457a6e0fde4b88ef848bfa9c",
            "sha256": "5d7fc58913c50f877f49d6483db570ad1bcff0d71765d379b7fb43b58c021530"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-modernanimation-2.3.8.tgz",
            "hashes": {
                "sha1": "d0e2bc047aaefcf2a7bfcb39408122ec624d4b28",
                "sha512_sri": "sha512-nNx+3Oj4BvEDfnviHhWkel/F3EDwFA3bhpzwII83oM6CINJzAHEdgZoz32XWXz4yx9O0QilGhzr2mSJDCPH83A=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]