🛡️ MAL-2026-4681 — tailwind-typography-stylecss

Malicious code in tailwind-typography-stylecss (npm)

Source: amazon-inspector

Package name 'tailwind-typography-stylecss' impersonates the official '@tailwindcss/typography' plugin; the shipped README is a verbatim copy of the official package's documentation, instructing users to install under the squatted name. The package's main entry src/index.js contains the legitimate plugin source followed by an appended obfuscated payload that fires on every require()/import. The payload uses a bespoke shuffle-cipher decoder (function sfL with constants n=2667686, modulus 4289487) to recover the string 'constructor', then invokes Function.constructor on a decoded body string and calls the resulting function — a classic dynamic-eval-of-opaque-blob construction. Before invocation, the code explicitly assigns require and module onto the global object (global[_$_1e42[0]]=require; global[_$_1e42[2]]=module) so that the dynamically constructed Function — which normally has no closure access to module-scope identifiers — can still reach Node's require and module APIs. The combination of name impersonation, verbatim-legitimate-source-plus-appended-payload, custom obfuscator, Function-constructor execution, and deliberate re-exposure of require/module on globals leaves no benign interpretation. Any project that follows the README and require()s this package executes attacker-controlled code in the consumer's Node process.

Source: ghsa-malware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.