MAL-2026-15903

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-container-queries/MAL-2026-15903.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15903
Published
2026-09-04T03:45:02Z
Modified
2026-09-04T04:30:05.842731291Z
Summary
Malicious code in tailwind-container-queries (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f)

On require of the package main, an appended eval(atob(...)) block in dist/index.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth) for the last transaction sent from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes the tx.to field into two IPv4 addresses. It fetches XOR-encrypted payloads from http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, decrypts them with hardcoded keys, eval's the first payload in-process, and launches the second via spawn('node', ['-e', <decoded>], {detached:true, stdio:'ignore', windowsHide:true}).unref() to leave a persistent detached Node process on the host. After execution the loader rewrites dist/index.js on disk to strip the eval block, removing the payload from the file to hinder later inspection. The package impersonates @tailwindcss/container-queries by copying its README verbatim and pointing the repository field at tailwindlabs/tailwindcss-container-queries. The on-chain C2 pointer lets the operator rotate destination IPs by publishing new Ethereum transactions, so the fetched code is fully attacker-controlled.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T04:21:20.64925723Z",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ],
            "id": "IN-MAL-2026-019447",
            "modified_time": "2026-09-04T03:45:02Z",
            "sha256": "c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-container-queries

Package

Name
tailwind-container-queries
View open source insights on deps.dev
Purl
pkg:npm/tailwind-container-queries

Affected ranges

Affected versions

0.*
0.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-container-queries/MAL-2026-15903.json"
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "tlsh": "c6325db4b3d332d07f2ca44219de6b0471af6dce2060738e8d465eea1445e63643d628",
            "sha256": "8e9c77f0cdfd5a3de18c77660ff7fcd1b46fd323f3b444602ae81d76c09dec5b"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-container-queries-0.1.1.tgz",
            "hashes": {
                "sha1": "056416840cc0354e7541290733facfe4d2dc0e7b",
                "sha512_sri": "sha512-hHvL1BWlIAYVfAjuPLBrCumc35ndwMAGVx/a0bK6wD5PmZdfNcjBDZxXIkLq/DRi8zRYqGgNbQNZMoKmcZHG8A=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]