Malicious code in tailwind-aspect (npm)
MAL-2026-15912
Published · Modified
Dependency scanning
Check whether tailwind-aspect is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf)
The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js, writes it to./inout.js, and require()s it every time a consumer imports the package. The fetched content is unpinned, unverified, and served over cleartext HTTP, giving the operator of that IP (and any on-path attacker) arbitrary code execution on the installer's machine at import time. The package name and repository metadata impersonate the official @tailwindcss/aspect-ratio plugin (repository points at tailwindlabs/tailwindcss-aspect-ratio), providing cover for the loader; the remote fetch has no relationship to any Tailwind plugin functionality.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes