A developer pasting colors into a Tailwind CSS file noticed an unusual pause and found obfuscated code hidden after empty lines. The file had been a malware drop site since his project started.
The clipboard lagged for a split second. When the developer pasted color tokens into a fresh tailwind.config.js, the pause was long enough to notice, and to run a diff that revealed thousands of trailing empty spaces hiding obfuscated JavaScript. The file his project was born with, the one he had not reopened since initialization, had become a malware drop site.
The discovery, first reported on infosecwriteups.com, is a single developer's anecdote. The pattern underneath it is not. tailwind.config.js is the file Tailwind CSS, a utility-class framework used in a large share of modern web projects, asks developers to create once at setup. It ships with create-next-app and most Next.js, Vite, and Astro starters. Most teams never look at it again.
That is exactly the property an attacker wants. The hidden payload runs at build time on the developer machine, then again any time the build is invoked. It opens a path to credential theft, GitHub token exfiltration, and process tampering, the same objectives Microsoft Security documented in May for typosquatted npm packages targeting CI/CD secrets.
The mechanism is confirmed independently of the seed post. A GitHub Community discussion reports the same technique used in force-pushes against legitimate repositories: an attacker with write access pushes a modified tailwind.config.js and a poisoned .gitignore, the changes ship through normal code review because the diff is mostly whitespace, and the obfuscated JavaScript executes on every developer who clones or pulls.
There is also a package-registry precedent. [Snyk flagged tailwind-config-overrides as malicious](https://security.snyk.io/vuln/SNYK-JS-TAILWINDCONFIGOVERRIDES-12485440), a typosquatted package aimed at developers searching for the right config file. The attack surface is not just a hand-edited config. It is the entire category of "thing with the Tailwind name that a developer might install or paste."
The broader ecosystem the seed post names, Trend Micro's Void Dokkaebi campaign, which uses fake job interviews to lure developers into cloning malicious repositories, and the PolinRider campaign, which published 108 malicious npm packages and extensions, points at the same vulnerability. Developer setup files are now an established target, not a hypothetical one. State-actor attribution for the specific tailwind.config.js payload is not independently confirmed; a Hacker News thread on the original post is openly skeptical of the DPRK framing. The broader pattern is.
What makes these files blind spots is mundane. tailwind.config.js, postcss.config.js, vite.config.ts, and webpack.config.js are scaffolded once by the framework CLI and then ignored. They rarely appear in pull-request diffs because they rarely change. A code review focused on application logic will not catch 4,000 trailing spaces followed by obfuscated JavaScript in a file marked as "config."
The fix is also mundane, which is the good news. Audit your scaffolded configs against the originals your framework CLI generates: npx tailwindcss init, npm create vite@latest, or the equivalent for your stack. Run a diff. Watch for trailing whitespace anomalies and for any line that begins after thousands of blank characters. Pin your build tooling to immutable lockfiles so a typosquatted tailwind-config-overrides cannot replace a real config in node_modules. Treat force-pushes that touch only tailwind.config.js and .gitignore as suspicious on sight.
The clipboard lag worked once. The next discovery probably will not announce itself with a visible pause.