Malicious code in tailwind-plugin-kit (npm)
The npm package 'tailwind-plugin-kit' version 1.3.2 contains malicious code that executes arbitrary JavaScript on the developer or build machine. The package's exported function makes an HTTPS request to a hardcoded IP address and executes the returned data as code with full Node.js context. This behavior can lead to execution of attacker-controlled code during the build process. The package also includes dependencies consistent with a second-stage infostealer targeting browser credentials and machine identifiers.
AI Analysis
Technical Summary
The 'tailwind-plugin-kit' npm package version 1.3.2 masquerades as a Tailwind CSS plugin toolkit but contains malicious functionality. Its exported 'getPlugin' function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109). The response's 'data.credits' field is passed to 'new Function(...)' and executed with full Node.js context, enabling arbitrary code execution on the host machine. The package attempts to disguise the network destination by assembling the URL from fragments and including unused references to well-known CDN hostnames as decoys. Declared dependencies such as '@primno/dpapi', 'better-sqlite3', and 'node-machine-id' align with a second-stage payload designed to steal browser credentials and machine identifiers from the infected host.
Potential Impact
Any project that installs and registers this package as a Tailwind plugin will trigger execution of attacker-controlled JavaScript code on the developer or build machine. This can lead to compromise of the build environment, theft of sensitive information such as browser credentials and machine identifiers, and potentially further system compromise depending on the payload delivered by the attacker.
Mitigation Recommendations
Avoid using the 'tailwind-plugin-kit' package version 1.3.2. Since no patch or remediation is indicated, do not install or remove this package if already present. Verify dependencies and source packages carefully before inclusion in projects. Monitor for updates or advisories from the package maintainers or npm regarding this issue. Consider using trusted and verified Tailwind CSS plugins only.
Malicious code in tailwind-plugin-kit (npm)
Description
The npm package 'tailwind-plugin-kit' version 1.3.2 contains malicious code that executes arbitrary JavaScript on the developer or build machine. The package's exported function makes an HTTPS request to a hardcoded IP address and executes the returned data as code with full Node.js context. This behavior can lead to execution of attacker-controlled code during the build process. The package also includes dependencies consistent with a second-stage infostealer targeting browser credentials and machine identifiers.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'tailwind-plugin-kit' npm package version 1.3.2 masquerades as a Tailwind CSS plugin toolkit but contains malicious functionality. Its exported 'getPlugin' function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109). The response's 'data.credits' field is passed to 'new Function(...)' and executed with full Node.js context, enabling arbitrary code execution on the host machine. The package attempts to disguise the network destination by assembling the URL from fragments and including unused references to well-known CDN hostnames as decoys. Declared dependencies such as '@primno/dpapi', 'better-sqlite3', and 'node-machine-id' align with a second-stage payload designed to steal browser credentials and machine identifiers from the infected host.
Potential Impact
Any project that installs and registers this package as a Tailwind plugin will trigger execution of attacker-controlled JavaScript code on the developer or build machine. This can lead to compromise of the build environment, theft of sensitive information such as browser credentials and machine identifiers, and potentially further system compromise depending on the payload delivered by the attacker.
Mitigation Recommendations
Avoid using the 'tailwind-plugin-kit' package version 1.3.2. Since no patch or remediation is indicated, do not install or remove this package if already present. Verify dependencies and source packages carefully before inclusion in projects. Monitor for updates or advisories from the package maintainers or npm regarding this issue. Consider using trusted and verified Tailwind CSS plugins only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14037
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7f43f1bf8831d5395d77c6
Added to database: 08/14/2026, 16:36:01 UTC
Last enriched: 08/14/2026, 16:52:48 UTC
Last updated: 08/14/2026, 16:52:48 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.