Malicious code in devpack-conf (npm)

Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethereum RPC/blockscout endpoints for transactions from the...

Malicious code in tailwind-container-queries (npm)

Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for the last transaction sent from the hardcoded address...

MAL-2026-15904 Malicious code in tailwind-scrollbar-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada dist/index.js exports a small tailwind plugin and then runs evalatob"Z2x..." on an embedded base64 blob at module load time. The decoded loader queri...

Malicious code in tailwindcss-fluid-styles (npm)

Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from the hardcoded address...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

Malicious code in tailwindcss-forms-style (npm)

Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after module.exports. The decoded payload queries public Ethereum RPC...

MAL-2026-15635 Malicious code in tailwind-modernanimation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...

MSC-2026-11442

Malicious code embedded in a trojanized package. tailwind-scrollbar-hider 5.0.2 is a typosquat of tailwind-scrollbar-hide. Its dist/index.js the package main keeps the legitimate one-line scrollbar CSS utility but appends evalatob... that runs at import time no install hook required. The decoded...

Malicious code in tailwind-form-templates (npm)

Source: amazon-inspector 8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an evalatob... payload that runs on require. The decoded payload obfuscates its...

Malicious code in tailwindcss-hide-scrollbar (npm)

Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package. The decoded payload pulls in http, https, zlib and...