Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

MAL-2026-12220 Malicious code in tailwind-animationpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3 src/index.js appends an obfuscated evalatob... block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and...

Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

Malicious code in @tailwind-ts/eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8feb6293e6f7cb00a6c6ab82e6d04f8eae29e846ae0abb8a1d65e2cdfbbc9c7 Package is published as an ESLint plugin for Tailwind CSS v4, but the shipped code implements unrelated Polymarket Kelly stake math and a postinstall...

MAL-2026-5619 Malicious code in tailwind-typography-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29345b97ddc8c5fe985d1a69d53db15e4126052929267a584b463e94f43b0bc3 [email protected] impersonates the legitimate @tailwindcss/typography Tailwind CSS plugin confusable name, copied plugin export shape,...