MAL-2026-5618

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f89c3c4c01375bc7baef213c815a901ac3947eaf3835aa80ea67a725ece8d533)

The package's main entry src/index.js appends, after a large whitespace gap following the legitimate-looking Tailwind plugin code, an eval(atob('Z2xvYmFsWychJ109JzExJzt2YXIgXyRfMWU0Mj0...')) call. The decoded first stage re-exposes Node's require and module as global aliases (global['c']=require, etc. — typo-style obfuscation) and then invokes a second-stage IIFE that uses a custom shuffle decoder plus the Function() constructor to assemble and execute a further opaque payload. Because this lives in the main entry, simply adding the plugin to tailwind.config.js executes attacker-controlled code inside the developer's build environment, where CI tokens, environment variables, source code, and credentials are all reachable. The package additionally impersonates the legitimate tailwindcss-animationfound plugin: the README copies its CSS class names and API surface verbatim, the install snippet uses yet another misspelling (tailwind-animatior-scroll), and a shields.io badge links to the real tailwindcss-animationfound package — a typosquat lure designed to catch developers who mistype or fuzzy-search for the legitimate plugin.

Source: ghsa-malware (819045fef6002491d4321e1c300c8898293fa9efa23b69eee504f5c56207fc8a)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.