Malicious code in tailwind-utility-kit (npm)
The npm package tailwind-utility-kit version 1.3.2 contains malicious code that executes arbitrary attacker-controlled code on any host that loads it. The package assembles a concealed URL pointing to a remote IP address, fetches JSON data, and executes the 'credits' field as code with full Node.js privileges. This behavior enables full compromise of the host environment. The package also includes decoy metadata to disguise its malicious intent and dependencies consistent with credential-stealing payloads.
AI Analysis
Technical Summary
The tailwind-utility-kit npm package version 1.3.2 is a malicious package masquerading as a Tailwind CSS utility library. Its default export dynamically constructs a URL from split fragments to a bare IP address (https://31.97.137.157:45000/icons/109), fetches JSON data from this endpoint, and extracts the 'credits' field. This field is passed to a dynamically created function via new Function, which is invoked with Node.js globals such as require, process, and Buffer, enabling arbitrary code execution with full Node privileges. The package includes decoy metadata referencing CDN-like domains and Font Awesome icons to mislead analysis. Its declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) align with a browser credential-stealing payload delivered through this remote loader mechanism.
Potential Impact
Any system that installs and runs tailwind-utility-kit version 1.3.2 is subject to arbitrary remote code execution with full Node.js privileges. This can lead to complete system compromise, including credential theft and unauthorized access to sensitive data. The malicious payload is dynamically loaded from a remote server, allowing the attacker to change the executed code at will.
Mitigation Recommendations
No official patch or fix is currently documented for this malicious package. The best mitigation is to avoid installing or using tailwind-utility-kit version 1.3.2. Remove any existing installations of this package from your environment. Monitor for any unexpected network connections to suspicious IP addresses such as 31.97.137.157 and investigate any signs of compromise. Use trusted sources and verify package integrity before installation.
Malicious code in tailwind-utility-kit (npm)
Description
The npm package tailwind-utility-kit version 1.3.2 contains malicious code that executes arbitrary attacker-controlled code on any host that loads it. The package assembles a concealed URL pointing to a remote IP address, fetches JSON data, and executes the 'credits' field as code with full Node.js privileges. This behavior enables full compromise of the host environment. The package also includes decoy metadata to disguise its malicious intent and dependencies consistent with credential-stealing payloads.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The tailwind-utility-kit npm package version 1.3.2 is a malicious package masquerading as a Tailwind CSS utility library. Its default export dynamically constructs a URL from split fragments to a bare IP address (https://31.97.137.157:45000/icons/109), fetches JSON data from this endpoint, and extracts the 'credits' field. This field is passed to a dynamically created function via new Function, which is invoked with Node.js globals such as require, process, and Buffer, enabling arbitrary code execution with full Node privileges. The package includes decoy metadata referencing CDN-like domains and Font Awesome icons to mislead analysis. Its declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) align with a browser credential-stealing payload delivered through this remote loader mechanism.
Potential Impact
Any system that installs and runs tailwind-utility-kit version 1.3.2 is subject to arbitrary remote code execution with full Node.js privileges. This can lead to complete system compromise, including credential theft and unauthorized access to sensitive data. The malicious payload is dynamically loaded from a remote server, allowing the attacker to change the executed code at will.
Mitigation Recommendations
No official patch or fix is currently documented for this malicious package. The best mitigation is to avoid installing or using tailwind-utility-kit version 1.3.2. Remove any existing installations of this package from your environment. Monitor for any unexpected network connections to suspicious IP addresses such as 31.97.137.157 and investigate any signs of compromise. Use trusted sources and verify package integrity before installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14190
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4caacd9273b49252b6e
Added to database: 08/19/2026, 13:51:06 UTC
Last enriched: 08/19/2026, 14:46:56 UTC
Last updated: 08/19/2026, 14:46:56 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.