OpenSSF/OSV advisory MAL-2026-14038 confirms this npm version as malicious. The package presents itself as a Tailwind CSS plugin, but its default export (which runs when users register it in tailwind.config) issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/109 and passes the response body's `credits` field into `new Function(require, module, exports,...)` for execution in the installer's Node process...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-toolkit (npm)
Details
The package presents itself as a Tailwind CSS plugin, but its default export (which runs when users register it in tailwind.config) issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/109 and passes the response body's `credits` field into `new Function(require, module, exports,...)` for execution in the installer's Node process. The destination URL is assembled from split variables and disguised with CDN/icon vocabulary (an unused `iconDomain` map referencing cloudflare/fastly/akamai, a `bearrtoken: "logo"` header, a response field named `credits`), while the actual host is an unrelated bare IP on a non-standard port. The package also declares dependencies on @primno/dpapi (Windows DPAPI credential decryption), better-sqlite3/sqlite3 (browser cookie and Login Data databases), and node-machine-id, indicating the retrieved payload is a browser-credential stealer. The remote host and executed bytes are fully attacker-controlled and unrelated to the advertised Tailwind CSS purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms tailwind-toolkit@1.3.2 as malicious (MAL-2026-14038): Malicious code in tailwind-toolkit (npm)