npm · Malicious package advisory
Malwareprocess-tailwind
GHSA-qm95-54f4-jjg8
Malicious code in process-tailwind (npm)
Details
**Severity:** Critical
**Affected versions:** `= 1.1.99`
## Source: amazon-inspector (d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432)
On require/import, index.js unconditionally calls initialize(), which spawns a detached, unref'd `node loader.js` child with stdio ignored and writes a PID file. loader.js fetches JSON from https://api.npoint.io/24c25d5f5fcbb0992a4f (a mutable third-party paste endpoint), base64-decodes the `code` field, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)(...)`, granting the remote endpoint operator arbitrary code execution on the installer's host. The remote URL is stored in a constant misleadingly named `API_KEY` and surrounded by comments describing the loader as a sandboxed educational component, contradicting the actual fetch-decode-eval behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9947fca3b118619628d7c35349b0b5d2b1852e1c/osv/malicious/npm/process-tailwind/MAL-2026-16179.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/9947fca3b118619628d7c35349b0b5d2b1852e1c/osv/malicious/npm/process-tailwind/MAL-2026-16179.json
- https://www.npmjs.com/package/process-tailwind/v/1.1.99
- https://github.com/advisories/GHSA-qm95-54f4-jjg8Compromised versions (1)
- = 1.1.99
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.