MAL-2026-4681

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (273b99f5721643d8ba8335fd73b46b4b32f81406d73f44e7a16552e16b8becd6)

Package name 'tailwind-typography-stylecss' impersonates the official '@tailwindcss/typography' plugin; the shipped README is a verbatim copy of the official package's documentation, instructing users to install under the squatted name. The package's main entry src/index.js contains the legitimate plugin source followed by an appended obfuscated payload that fires on every require()/import. The payload uses a bespoke shuffle-cipher decoder (function sfL with constants n=2667686, modulus 4289487) to recover the string 'constructor', then invokes Function.constructor on a decoded body string and calls the resulting function — a classic dynamic-eval-of-opaque-blob construction. Before invocation, the code explicitly assigns require and module onto the global object (global[_$1e42[0]]=require; global[$_1e42[2]]=module) so that the dynamically constructed Function — which normally has no closure access to module-scope identifiers — can still reach Node's require and module APIs. The combination of name impersonation, verbatim-legitimate-source-plus-appended-payload, custom obfuscator, Function-constructor execution, and deliberate re-exposure of require/module on globals leaves no benign interpretation. Any project that follows the README and require()s this package executes attacker-controlled code in the consumer's Node process.