Malicious code in tailwindcss-motion-advanced (npm)
The npm package tailwindcss-motion-advanced contained malicious code that queries Ethereum RPC endpoints to retrieve C2 server addresses and executes remotely fetched JavaScript payloads. The package was presented as a Tailwind CSS plugin but had no legitimate need for blockchain access or remote code execution.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed tailwindcss-motion-advanced
- Ecosystems
- Attack vectors
- Affected entities
- tailwindcss-motion-advancednpm package containing malicious code
The npm package tailwindcss-motion-advanced was found to contain malicious code in its main entry point (lib/utils.min.js). Upon require, the package queries multiple Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) to retrieve the latest outbound transaction from a hardcoded attacker address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a).\n\nThe malicious code parses two IPv4 C2 hosts from the transaction's to field, then fetches an XOR-encoded JavaScript payload over plain HTTP from http://<C2>:443/0x/cls. The payload is decoded and executed via both eval() and a detached Node.js process spawned with the decoded payload.\n\nSensitive identifiers including module names, URLs, HTTP methods, and the attacker address are obfuscated using Unicode escapes (\uXXXX). The response body and x-payload-b64 header are XOR-decoded with a per-URL key before execution. A Tailwind CSS plugin has no legitimate need for Ethereum RPC access, IP derivation from blockchain data, or remote code execution.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-7p82-x6rm-hphv.
Indicators of compromise
- Packages
- tailwindcss-motion-advanced
- Domains
- eth.blockscout.com
- 1rpc.io
- eth.drpc.org
- ethereum-rpc.publicnode.com
- eth-mainnet.public.blastapi.io
Remediation
- Immediately uninstall tailwindcss-motion-advanced from all systems
- Audit npm package.lock or yarn.lock files for any installations of tailwindcss-motion-advanced
- Review system logs and network traffic for connections to the identified Ethereum RPC endpoints and any C2 servers
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update to a safe version or use an alternative Tailwind CSS plugin
- Monitor for any suspicious outbound network connections from systems that had this package installed
Sources
- GitHub Advisory GHSA-7p82-x6rm-hphv · GitHub Advisory Database
Cite this entry
"Malicious code in tailwindcss-motion-advanced (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-tailwindcss-motion-advanced-npm-1sj9sd
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package