{"answers":{"affected":"1 open source package ship an affected version, including tailwind-typography-stylecss.","exploited":"There is no known exploitation of MAL-2026-4681 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4681 is a malicious package in tailwind-typography-stylecss, published on 24 May 2026."},"fix_prompt":"MAL-2026-4681 is a malicious package: tailwind-typography-stylecss (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4681/ (Markdown: https://insights.sbomify.com/MAL-2026-4681/index.md)","id":"MAL-2026-4681","markdown":"https://insights.sbomify.com/MAL-2026-4681/index.md","name":"MAL-2026-4681","record":{"aliases":["GHSA-p258-w6jm-c6ff"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name 'tailwind-typography-stylecss' impersonates the official '@tailwindcss/typography' plugin; the shipped README is a verbatim copy of the official package's documentation, instructing users to install under the squatted name. The package's main entry src/index.js contains the legitimate plugin source followed by an appended obfuscated payload that fires on every require()/import. The payload uses a bespoke shuffle-cipher decoder (function sfL with constants n=2667686, modulus 4289487) to recover the string 'constructor', then invokes Function.constructor on a decoded body string and calls the resulting function — a classic dynamic-eval-of-opaque-blob construction. Before invocation, the code explicitly assigns require and module onto the global object (global[_$_1e42[0]]=require; global[_$_1e42[2]]=module) so that the dynamically constructed Function — which normally has no closure access to module-scope identifiers — can still reach Node's require and module APIs. The combination of name impersonation, verbatim-legitimate-source-plus-appended-payload, custom obfuscator, Function-constructor execution, and deliberate re-exposure of require/module on globals leaves no benign interpretation. Any project that follows the README and require()s this package executes attacker-controlled code in the consumer's Node process.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tailwind-typography-stylecss (npm)","id":"MAL-2026-4681","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"tailwind-typography-stylecss","purl":"pkg:npm/tailwind-typography-stylecss","source":"MAL-2026-4681"}],"products":null,"published":"2026-05-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4681/"}