{"answers":{"affected":"1 open source package ship an affected version, including tailwind-scrollbar-styles.","exploited":"There is no known exploitation of MAL-2026-15904 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-15904 is a malicious package in tailwind-scrollbar-styles, published on 4 Sep 2026."},"fix_prompt":"MAL-2026-15904 is a malicious package: tailwind-scrollbar-styles (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-15904/ (Markdown: https://insights.sbomify.com/MAL-2026-15904/index.md)","id":"MAL-2026-15904","markdown":"https://insights.sbomify.com/MAL-2026-15904/index.md","name":"MAL-2026-15904","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"dist/index.js exports a small tailwind plugin and then runs eval(atob(\"Z2x...\")) on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints (1rpc.io/eth, drpc.org, publicnode, blastapi.io) and Blockscout for the most recent transaction sent by hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes four bytes of that transaction's `to` field into an IPv4 address, HTTP-GETs http://\u003cdecoded-ip\u003e:443/0x/cls and http://\u003cdecoded-ip\u003e:443/0x/ls, XOR-decodes the response with literal keys, and executes it via eval() and via a detached `spawn(\"node\", [\"-e\",...], {detached:true, stdio:\"ignore\", windowsHide:true}).unref()`. After first execution the loader reads its own file, locates the `eval(atob(\"Z2x...` region, and rewrites dist/index.js with the region removed, so the malicious line disappears from disk. The Ethereum-transaction-based resolver lets the operator rotate the C2 IP at any time by publishing a new transaction from the controlling address, and the self-erasing stub defeats post-incident inspection of the installed copy.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tailwind-scrollbar-styles (npm)","id":"MAL-2026-15904","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"tailwind-scrollbar-styles","purl":"pkg:npm/tailwind-scrollbar-styles","source":"MAL-2026-15904"}],"products":null,"published":"2026-09-04","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-15904/"}