MAL-2026-18334

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (21c91b39929f03c30e501726fc2d1c1fa43f17bf2ed77bda52380e563c1171e0)

The package advertises itself as a zero-runtime CSS theming kit but on require/import executes a chain of obfuscated JavaScript modules. lib.mjs imports tokens.mjs, which top-level imports cache-warm.mjs — a ~279KB single-line file consisting of a hex-named string array of XOR/base64-encoded blobs decoded at runtime. Three additional sibling modules of the same shape (build-cache.mjs ~203KB, cache-sweep.mjs ~295KB, workspaces.js ~290KB) are shipped and listed in the published files manifest. Alongside the JavaScript loader, the tarball bundles prebuilt N-API native binaries at native/{linux,darwin,win32}/{arm64,x64}/cache-probe.node whose exported symbols implement extensive hypervisor, container, and sandbox detection (VMDetect/VMDetector classes, hypervisor_bit, qemu_fw_cfg, systemd_virt, dockerenv, bluestacks, vbox_module, podman_file, wsl_proc_subdir, amd_sev_msr, azure, chassis_vendor, mac_address_check, is_x86_process_on_arm). None of this has any role in CSS custom-property emission. The README instructs installation as npm install -D tailwindcss@npm:postcss-semantic-themes, aliasing the legitimate tailwindcss name onto this package so existing import 'tailwindcss' call sites resolve to the obfuscated loader. The combination of an import-time obfuscated loader, multiple additional staged obfuscated payloads, environment-fingerprinting native code to gate execution to non-analyst hosts, and a brandjacking install instruction is the structural shape of a staged supply-chain payload rather than a theming plugin.

Source: ghsa-malware (d188bb5d3c330ed5c438865b3787cca124861eefe2c8e094e58511bbca437e09)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The...