GCVE-110-OSM-2026-4187

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published May 14, 2026

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. [osmalyze-auto] Entrypoint: src/index.js (main: src/index.js) Payload: src/index.js Key findings: - Indirect Function Constructor Access in src/index.js: "['constructor']" - Data Encoding for Exfiltration in src/index.js: "encodeURIComponent(_0x50ffaa),_0x5e4db8[_0x7a7b3b(0x3dc,0x3ba)])+(_0xb319a9()?_0..." - Whitespace-Padded Hidden Payload in src/index.js: "; ..." - Obfuscation: augmented proxied array function replacements in src/index.js - Obfuscation Pattern: hexVariables in src/index.js: "_0x4767" IOCs: - urls: https://tailwindcss.com/docs/typography-plugin, https://play.tailwindcss.com/uj1vGACRJA?layout=preview, https://tailwindcss.com/docs/responsive-design, https://tailwindcss.com/docs/hover-focus-and-other-states, https://tailwindcss.com/discord - domains: tailwindcss.com, play.tailwindcss.com, nicolasgallagher.com, v3.tailwindcss.com - payloadFileHash: 227b58b46968b0f0771baf98a224bfcc400f77ed127d714237f6450f58771062

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	typography-stylecss	all (affected)	—

References

Malicious npm package: typography-stylecss

advisory

vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON