🛡️ MAL-2026-12218 — tailwind-animation-founder

Malicious code in tailwind-animation-founder (npm)

Source: amazon-inspector

The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream ('tailwindcss-animationfound'), indicating a typosquat identity. src/index.js appends an obfuscated IIFE after a legitimate-looking Tailwind plugin export. The trailing block pulls http, https, and child_process.spawn into globals, uses a length-based string-shuffle routine to reconstruct the identifier 'constructor', instantiates a Function from a shuffle-decoded source blob, and immediately invokes it. The executable payload is only readable after runtime decoding, so the plugin performs opaque code execution the moment a build tool runs require('tailwind-animation-founder'). The combination of obfuscation, networking primitives (http/https), process-spawn capability, and Function-constructor evaluation on the main entry is the shape of a dropper/stealer, not a Tailwind utility plugin.