MAL-2026-15904

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-scrollbar-styles/MAL-2026-15904.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15904
Published
2026-09-04T03:45:17Z
Modified
2026-09-04T04:30:06.559794118Z
Summary
Malicious code in tailwind-scrollbar-styles (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada)

dist/index.js exports a small tailwind plugin and then runs eval(atob("Z2x...")) on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints (1rpc.io/eth, drpc.org, publicnode, blastapi.io) and Blockscout for the most recent transaction sent by hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes four bytes of that transaction's to field into an IPv4 address, HTTP-GETs http://<decoded-ip>:443/0x/cls and http://<decoded-ip>:443/0x/ls, XOR-decodes the response with literal keys, and executes it via eval() and via a detached spawn("node", ["-e",...], {detached:true, stdio:"ignore", windowsHide:true}).unref(). After first execution the loader reads its own file, locates the eval(atob("Z2x... region, and rewrites dist/index.js with the region removed, so the malicious line disappears from disk. The Ethereum-transaction-based resolver lets the operator rotate the C2 IP at any time by publishing a new transaction from the controlling address, and the self-erasing stub defeats post-incident inspection of the installed copy.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T04:21:20.748618397Z",
            "source": "amazon-inspector",
            "versions": [
                "4.0.3"
            ],
            "id": "IN-MAL-2026-019449",
            "modified_time": "2026-09-04T03:45:17Z",
            "sha256": "2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-scrollbar-styles

Package

Name
tailwind-scrollbar-styles
View open source insights on deps.dev
Purl
pkg:npm/tailwind-scrollbar-styles

Affected ranges

Affected versions

4.*
4.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-scrollbar-styles/MAL-2026-15904.json"
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "tlsh": "10224bb5a3c323c46f2db5426adc6b4862ab2cce11f433ce4d451fea1485e53257c56c",
            "sha256": "0eb89136a6553f65d2e4fa3a382276ec53d624750143bc9ba27888fe7ef3aba1"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-scrollbar-styles-4.0.3.tgz",
            "hashes": {
                "sha1": "cae64ff2a6a8913da032ab9c930bc2c59ccbc8e8",
                "sha512_sri": "sha512-qVwJGZ9tCwbnTMBkOPVmpzp5ylk4Uz9MazaxT0XxPMSpL0G9ZpsNaSo6GYf35yBCttVeNN6sLddjZ2XumRjwbg=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]