MAL-2026-6471

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-color-shades/MAL-2026-6471.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6471
Published
2026-06-25T18:43:49Z
Modified
2026-06-25T19:31:22.889419219Z
Summary
Malicious code in tailwind-color-shades (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dfd681005962f5628f4394450bae9430992e58159e3256bb4af2bc156c5c1fc5)

The package's documented entry point index.ts begins with import './src/bootstrap';, which causes src/bootstrap.js to run whenever the module is required or imported. src/bootstrap.js is a custom string-shuffle obfuscator: a function YWG(x) deterministically unscrambles opaque string literals (e.g. YWG('axhscuutcrogycrneotisjlnkdpfqmzovtrwb').substr(0,11) reconstructs the literal 'constructor'), then uses Function.prototype.constructor to build a Function from one shuffled blob, executes it on a second shuffled blob, and invokes the result via XZs(7942). Before invoking the constructed code the bootstrap explicitly re-exposes Node capabilities to it via global['r']=require; global['m']=module;, granting the dynamically generated payload full filesystem, child_process, and network access. The package's advertised purpose is straightforward Tailwind color-shade math — a few dozen lines of pure arithmetic — so a hand-rolled string-shuffle obfuscator wrapping Function-constructed code at import time has no legitimate purpose. This is the standard supply-chain attack shape: opaque payload, evasion-only obfuscation, automatic execution on consumer import, full Node capability re-export.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-25T19:13:49.596882938Z",
            "source": "amazon-inspector",
            "sha256": "dfd681005962f5628f4394450bae9430992e58159e3256bb4af2bc156c5c1fc5",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-007531",
            "modified_time": "2026-06-25T18:43:49Z"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-color-shades

Package

Name
tailwind-color-shades
View open source insights on deps.dev
Purl
pkg:npm/tailwind-color-shades

Affected ranges

Affected versions

1.*
1.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "26815cc43148fdc978c042b081cb919f2c6506e2d87fb1c4888e86ea65422465eb9aff",
            "sha256": "8c031bc55a321bae573f52f953e383c949b57225cc004d1f3c15300f770c0af3",
            "path": "src/bootstrap.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-color-shades-1.0.2.tgz",
            "hashes": {
                "sha1": "20d89e126abc68e74e01f1a8701b68dfc29005fa",
                "sha512_sri": "sha512-JifrB2+zxDatB0NU3qm7yKN925z9kuwoM1gakcPkYpgtnbEJ27JHW3OnomJmdpO/sFeZ6Aer0OsYJ4HxhHSepA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-color-shades/MAL-2026-6471.json"