MAL-2026-16056

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-aspect-styles/MAL-2026-16056.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16056
Published
2026-09-08T23:55:46Z
Modified
2026-09-09T01:00:05Z
Summary
Malicious code in tailwind-aspect-styles (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14)

The package's main module (src/index.js) performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in the consumer's working directory, and immediately require()s the written file. The fetch is unpinned, unauthenticated, and served from a bare IP over cleartext, so the operator of that endpoint controls arbitrary JavaScript executed in the Node process that loads this package. The package presents itself as the Tailwind aspect-ratio plugin, with a package.json repository field pointing to tailwindlabs/tailwindcss-aspect-ratio, while the dropper is appended after the legitimate-looking plugin export.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019722",
            "import_time": "2026-09-09T00:47:57.620002484Z",
            "modified_time": "2026-09-08T23:55:46Z",
            "sha256": "4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14",
            "source": "amazon-inspector",
            "versions": [
                "0.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-aspect-styles

Package

Name
tailwind-aspect-styles
View open source insights on deps.dev
Purl
pkg:npm/tailwind-aspect-styles

Affected ranges

Affected versions

0.*
0.4.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "2675b2db17a311c8c48797fb24aaeed4d548c598f165f7a55ce5f74f76669f62",
            "tlsh": "f43165b1068185044861769793619c42e6dbb1b4ce7e8082ead54c7947c1dd1bb12ebb"
        },
        {
            "path": "package.json",
            "sha256": "d9183021b7acf6519b2b06eace5c2d8dcd7b96aa5976656ffa9a1c3544f12a81",
            "tlsh": "12f07822ce240e7305e4716197b91597a2a318278418bc0e31c2860c8b8c5aff0f966d"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-aspect-styles-0.4.2.tgz",
            "hashes": {
                "sha1": "b719db600915fadcfa0802e4c102b9595c1a1eaf",
                "sha512_sri": "sha512-r0XSNvaQ5iDpp1/L3nsVvTG4xEKMXjLWlNs0AnSvsCRAUPWdp80qDU5TpISjMsJsLlphArL40//p2zj68Zw7eQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-aspect-styles/MAL-2026-16056.json"