Malicious code in tailwind-toolkit (npm)
The npm package tailwind-toolkit contained malicious code that executes arbitrary remote payloads during installation and registration in tailwind.config. The package masquerades as a Tailwind CSS plugin but fetches and executes code from a hardcoded IP endpoint (31.97.137.157:45000) and steals browser credentials using Windows DPAPI and SQLite database access.
- Disclosed
- Last updated
- Blast radius
- Any npm user who installed and used tailwind-toolkit as a Tailwind CSS plugin in their build process.
- Ecosystems
- Attack vectors
- Affected entities
- tailwind-toolkitnpm package presenting as Tailwind CSS plugin but containing malicious code
The npm package tailwind-toolkit was distributed with malicious code designed to execute arbitrary remote payloads. When registered as a Tailwind CSS plugin in a user's tailwind.config file, the package's default export initiates an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/109.
The malicious behavior is heavily obfuscated through deceptive naming and structure. The destination URL is assembled from split variables and disguised with CDN and icon-related vocabulary, including an unused iconDomain map referencing legitimate CDN providers (Cloudflare, Fastly, Akamai) and a misleading bearrtoken: "logo" header. The response body's credits field is passed directly into new Function(require, module, exports,...) for execution within the installer's Node process.
The package declares dependencies on @primno/dpapi (Windows DPAPI credential decryption), better-sqlite3/sqlite3 (for accessing browser cookie and Login Data databases), and node-machine-id, indicating the remotely-executed payload is designed to steal browser credentials and system identifiers. The remote host and executed bytecode are fully attacker-controlled and unrelated to any legitimate Tailwind CSS functionality.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- tailwind-toolkit
- IPs
- 31.97.137.157
Remediation
- Immediately uninstall tailwind-toolkit from all projects and npm environments
- Remove any references to tailwind-toolkit from tailwind.config files and package.json
- Audit npm install logs and build artifacts for evidence of execution from 31.97.137.157:45000
- If the package was installed and used, assume browser credentials and system identifiers may be compromised; reset passwords for accounts accessed from affected machines
- Review browser cookie stores and Login Data databases for unauthorized access
- Implement npm package pinning and verification practices to prevent installation of malicious packages
- Monitor for similar obfuscated packages using bare-IP endpoints or split URL assembly patterns
Sources
- GitHub Advisory GHSA-w8j5-2277-r9rg · GitHub Advisory Database
Cite this entry
"Malicious code in tailwind-toolkit (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-tailwind-toolkit-npm-1fz5js
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package