{"id":"MAL-2026-18082","kind":"package","aliases":["MAL-2026-18082"],"related":[],"title":"Malicious code in tailwind-fabric (npm)","description":"tailwind-fabric (3.0.1, 3.0.4) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"tailwind-fabric","fixed":[],"affected":"= 3.0.1; = 3.0.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T00:00:00+00:00","first_seen_at":"2026-10-26T20:51:47+00:00","triaged_at":"2026-10-26T21:04:10+00:00","updated_at":"2026-10-26T21:04:10+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-07':138C '-09':56C,143C '-10':142C '-17665':38C '-17666':42C '-18082':10A,13A '-2026':9A,12A,37C,41C '-28':57C,139C '2026':55C,137C,141C '3.0.1':22C '3.0.4':23C '5':59C 'aaron205whitmore/postcss-animate-utils':65C 'account':133C 'animate.css':45C 'behind':35C 'campaign':34C 'code':2A,90C,114C 'commit':81C 'contain':107C 'css':27C 'deliv':92C 'depend':121C 'descript':50C 'dev':101C 'fabric':6A,16A,21C 'fake':31C 'instal':109C 'integr':46C 'interview':33C 'job':32C 'johnxia1997':53C 'live':117C 'load':96C 'lure':84C 'mal':8A,11A,36C,40C 'malici':1A,17B 'network':113C 'npm':7A,79C 'packag':18B,64C,130C 'payload':116C 'plugin':28C,98C 'privat':62C,120C 'public':72C 'publish':51C,105C,135C 'readabl':69C 'readm':48C 'registri':73C 'repositori':85C 'requir':60C 'resolv':75C 'retriev':125C 'run':93C 'scope':63C 'script':110C 'server':102C 'seventeen':132C 'six':128C 'src/motion.js':58C 'start':103C 'tailwind':5A,15A,20C,26C 'tailwind-fabr':4A,19C 'tailwind-fabric':14A 'tailwind.config.js':95C 'tarbal':106C 'templat':47C 'token':80C 'twenti':127C 'twenty-six':126C 'web/.npmrc':87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18082","url":"https://osv.dev/vulnerability/MAL-2026-18082","severity":"critical","published_at":"2026-10-19T00:00:00+00:00","modified_at":"2026-10-20T06:15:04+00:00","first_seen_at":"2026-10-26T20:51:47+00:00","fetched_at":"2026-10-26T20:51:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}