Malicious code in tailwind-container-queries (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f) On require of the package main, an appended eval(atob(...)) block in dist/index.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth) for the last transaction sent from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes the tx.to field into two IPv4 addresses. It fetches XOR-encrypted payloads from http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, decrypts them with hardcoded keys, eval's the first payload in-process, and launches the second via spawn('node', ['-e', <decoded>], {detached:true, stdio:'ignore', windowsHide:true}).unref() to leave a persistent detached Node process on the host. After execution the loader rewrites dist/index.js on disk to strip the eval block, removing the payload from the file to hinder later inspection. The package impersonates @tailwindcss/container-queries by copying its README verbatim and pointing the repository field at tailwindlabs/tailwindcss-container-queries. The on-chain C2 pointer lets the operator rotate destination IPs by publishing new Ethereum transactions, so the fetched code is fully attacker-controlled.
Malicious code in tailwind-container-queries (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f) On require of the package main, an appended eval(atob(...)) block in dist/index.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth) for the last transaction sent from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes the tx.to field into two IPv4 addresses. It fetches XOR-encrypted payloads from http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, decrypts them with hardcoded keys, eval's the first payload in-process, and launches the second via spawn('node', ['-e', <decoded>], {detached:true, stdio:'ignore', windowsHide:true}).unref() to leave a persistent detached Node process on the host. After execution the loader rewrites dist/index.js on disk to strip the eval block, removing the payload from the file to hinder later inspection. The package impersonates @tailwindcss/container-queries by copying its README verbatim and pointing the repository field at tailwindlabs/tailwindcss-container-queries. The on-chain C2 pointer lets the operator rotate destination IPs by publishing new Ethereum transactions, so the fetched code is fully attacker-controlled.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-15903
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a9ad4edacd9273b49b67820
Added to database: 09/04/2026, 14:25:49 UTC
Last updated: 09/04/2026, 14:25:49 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.