MAL-2026-16179

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/process-tailwind/MAL-2026-16179.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16179
Published
2026-09-15T15:55:20Z
Modified
2026-09-15T16:31:19Z
Summary
Malicious code in process-tailwind (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432)

On require/import, index.js unconditionally calls initialize(), which spawns a detached, unref'd node loader.js child with stdio ignored and writes a PID file. loader.js fetches JSON from https://api.npoint.io/24c25d5f5fcbb0992a4f (a mutable third-party paste endpoint), base64-decodes the code field, and executes it via new Function('require','__dirname','__filename','module','exports', decodedCode)(...), granting the remote endpoint operator arbitrary code execution on the installer's host. The remote URL is stored in a constant misleadingly named API_KEY and surrounded by comments describing the loader as a sandboxed educational component, contradicting the actual fetch-decode-eval behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020063",
            "import_time": "2026-09-15T16:19:15.669518243Z",
            "modified_time": "2026-09-15T15:55:20Z",
            "sha256": "d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432",
            "source": "amazon-inspector",
            "versions": [
                "1.1.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / process-tailwind

Package

Name
process-tailwind
View open source insights on deps.dev
Purl
pkg:npm/process-tailwind

Affected ranges

Affected versions

1.*
1.1.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "loader.js",
            "sha256": "21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6",
            "tlsh": "7e5121a60afb3512027770e6bb0b596a96bbe113314ec994fa9cc3d44fc2421d6d72dc"
        },
        {
            "path": "init.js",
            "sha256": "414208fccb89273ad5dc8787c58cadd5139bcc1b0d35fbc2f6a6719e46a1b405",
            "tlsh": "5c2142ab286a4b3981b2c4aa471fc51013a6d1777254f9a9f5ce87b56f0671cca238c8"
        }
    ],
    "package_integrity": [
        {
            "filename": "process-tailwind-1.1.99.tgz",
            "hashes": {
                "sha1": "52b4fa9bc62dc4600b22486d68df29a95d27e7e1",
                "sha512_sri": "sha512-Mb1ZdUeOWQSnozK9OB42i1FQDqDc4MCD12DaEbxVbY5PfOZ7EWzpJ4XTPwbqt1kY5sY9cS40hwzLhdQ00qfZrw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/process-tailwind/MAL-2026-16179.json"