{"answers":{"affected":"1 open source package ship an affected version, including tailwind-opentype.","exploited":"There is no known exploitation of MAL-2026-12222 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12222 is a malicious package in tailwind-opentype, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12222 is a malicious package: tailwind-opentype (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12222/ (Markdown: https://insights.sbomify.com/MAL-2026-12222/index.md)","id":"MAL-2026-12222","markdown":"https://insights.sbomify.com/MAL-2026-12222/index.md","name":"MAL-2026-12222","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"dist/index.js re-exports a benign Tailwind plugin and appends an eval(atob(...)) payload that runs when the module is required (e.g. from a project's tailwind.config). The decoded payload uses \\u-escaped module names to require('http'), require('https'), and require('child_process'), then queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com) for transactions from a hardcoded attacker address (0xa322E5f3D311D3080e6f01210633e9aDC2490Ef1). The transaction's `to` field is decoded into a pair of C2 IPs, from which an XOR-encoded stage-2 payload is fetched over HTTP at /0x/cls and /0x/ls with an x-payload-b64 header, and executed both via eval() and via a detached spawn('node', ['-e',...]).unref(). Every network destination, module name, and identifier is stored as \\u-escaped sequences and the outer payload is base64-wrapped in eval(atob()) to defeat static review. Loading the module yields full remote code execution on the build host with attacker-controlled, on-chain-resolved payloads.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tailwind-opentype (npm)","id":"MAL-2026-12222","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"tailwind-opentype","purl":"pkg:npm/tailwind-opentype","source":"MAL-2026-12222"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12222/"}