Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed typography-stylecss and included it in their Tailwind configuration; the malicious code executes at module load time during build or dev server startup.
- Ecosystems
- Attack vectors
- Affected entities
- typography-stylecssMalicious npm package impersonating @tailwindcss/typography
The package typography-stylecss was published to npm as a malicious impersonation of the legitimate @tailwindcss/typography plugin from Tailwind Labs. The attacker copied the README, source files (src/index.js, src/utils.js, src/styles.js), and peerDependencies verbatim from the genuine plugin to create a convincing masquerade.\n\nEmbedded in src/index.js after the legitimate module exports is obfuscated malicious code using obfuscator.io-style techniques with hex-named identifiers and a rotated string table. The decoded payload includes platform detection logic ('win32', 'windows', 'agent-linux-') and constructs a URL path template /agents/ against a base URL read from a __SSTAR_API_BASE global variable, indicating intent to download and execute a platform-specific binary.\n\nBecause the malicious code executes at module top level, it triggers immediately on require() or import of the package—exactly the usage pattern the cloned README instructs developers to add to their tailwind.config.js. Any build process or development server that loads the Tailwind configuration will execute the dropper, fetching and running an attacker-controlled native binary on the developer's machine.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- typography-stylecss
Remediation
- Immediately uninstall typography-stylecss from all projects: npm uninstall typography-stylecss
- Audit package.json and lock files to identify any installations of typography-stylecss
- If installed, assume the machine may be compromised; review process logs and network connections during the time the package was installed and used
- Use the legitimate @tailwindcss/typography package instead
- Implement npm package name verification and typosquatting detection in dependency review workflows
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-vqg5-mfj2-mmrr · GitHub Advisory Database
Cite this entry
"Malicious code in typography-stylecss (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-typography-stylecss-npm-19m21i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting