registry / Remote code execution / @tailwindxss/postcss

@tailwindxss/postcss

PostCSS plugin for Tailwind CSS, a utility-first CSS framework for rapidly building custom user interfaces

This report shows the evidence for @tailwindxss/postcss@4.3.4. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a typosquat of the official Tailwind PostCSS plugin with a hidden SVG-comment loader. On plugin run it decodes and executes arbitrary JavaScript from project SVG files, which is concrete malware.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing this package and running it as a PostCSS plugin during a CSS build.

Impact

Arbitrary JavaScript runs in the build with the developer's file system and environment access.

Mechanism

SVG HTML-comment harvest, base64 decode, and AsyncFunction execution

Attack narrative

A user who mistakes this for the official Tailwind PostCSS plugin installs it and runs a CSS build. The plugin then recursively reads SVG files from common asset folders, pulls HTML comments, base64-decodes them, and executes the result as JavaScript. A planted comment or a later-dropped SVG can run arbitrary code in the build with the developer's privileges.

AI rationale

Evidence

package.jsondist/index.jsdist/index.mjspublicassetssrc/assetsapp/assets

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The published name and branding copy official Tailwind CSS while the scope is @tailwindxss and the git remote is olienath/tailwindxss.
When the PostCSS plugin runs, both compiled entries recursively walk public, assets, src/assets, and app/assets for .svg files.
HTML comments in those SVGs are base64-decoded and executed with the AsyncFunction constructor, and errors are swallowed.

Evidence against

package.json has no preinstall, install, or postinstall hooks.
There is no child_process usage; NODE_ENV is only used to toggle CSS optimize.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

MinifiedPossibleObfuscation

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 92.4 KB of source

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-11javascript

1"use strict";var ot=Object.create;var xe=Object.defineProperty;var lt=Object.getOwnPropertyDescriptor;var at=Object.getOwnPropertyNames;var st=Object.getPrototypeOf,ut=Object.prototype.hasOwnProperty;var we=(e,r)=>(r=Symbol[e])?r:Symbol.for("Symbol."+e),ye=e=>{throw TypeError(e)};var ct=(e,r,t,l)=>{if(r&&typeof r=="object"||typeof r=="function")for(let o of at(r))!ut.call(e,o)&&o!==t&&xe(e,o,{get:()=>r[o],enumerable:!(l=lt(r,o))||l.enumerable});return e};var J=(e,r,t)=>(t=e!=null?ot(st(e)):{},ct(r||!e||!e.__esModule?xe(t,"default",{value:e,enumerable:!0}):t,e));var Ae=(e,r,t)=>{if(r!=null){typ ...

2`,`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L1

3`);let r=[],t=[],l=null,o="",n;for(let i=0;i<e.length;i++){let a=e.charCodeAt(i);switch(a){case Se:{o+=e[i]+e[i+1],i++;break}case vt:{if(o.length>0){let s=L(o);l?l.nodes.push(s):r.push(s),o=""}let u=L(e[i]);l?l.nodes.push(u):r.push(u);break}case Te:case Ne:case $e:case Ve:case Ee:case Re:case Pe:case Oe:{if(o.length>0){let f=L(o);l?l.nodes.push(f):r.push(f),o=""}let u=i,s=i+1;for(;s<e.length&&(n=e.charCodeAt(s),!(n!==Te&&n!==Ne&&n!==$e&&n!==Ve&&n!==Ee&&n!==Re&&n!==Pe&&n!==Oe));s++);i=s-1;let c=pt(e.slice(u,s));l?l.nodes.push(c):r.push(c);break}case ht:case mt:{let u=i;for(let s=i+1;s<e.length; ...

4`,r){t+=s.length;let c=t;t+=i.property.length,t+=2,t+=i.value?.length??0,i.important&&(t+=11);let f=t;t+=2,i.dst=

5`,r){t+=s.length;let c=t;t+=i.selector.length,t+=1;let f=t;i.dst=[l,c,f],t+=2}for(let c of i.nodes)u+=o(c,a+

6`,r&&(t+=s.length,t+=2)}else if(i.kind==="at-rule"){if(i.nodes.length===0){let c=`${s}${i.name} ${i.params

7`;if(r){t+=s.length;let f=t;t+=i.name.length,t+=1,t+=i.params.length;let k=t;t+=2,i.dst=[l,f,k]}return c}if(u

8`,r){t+=s.length;let c=t;t+=i.name.length,i.params&&(t+=1,t+=i.params.length),t+=1;let f=t;i.dst=[l,c,f],t+=2}for

9`,r&&(t+=s.length,t+=2)}else if(i.kind==="comment"){if(u+=`${s}/*${i.value}*/

10`,r){t+=s.length;let c=t;t+=2+i.value.length+2;let f=t;i.dst=[l,c,f],t+=1}}else if(i.kind==="context"||i.kind===

Long lines were clipped for display.

•matchType = malicious_source_fingerprint_signature signature = c0cc8f595bc85042 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tailwindxss/postcss@4.3.3 matchedPath = dist/index.js matchedIdentity = npm:QHRhaWx3aW5keHNzL3Bvc3Rjc3M:4.3.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

package.jsonView file

Lines 1-22json

2 "name": "@tailwindxss/postcss",

3 "version": "4.3.4",

4 "description": "PostCSS plugin for Tailwind CSS, a utility-first CSS framework for rapidly building custom user interfaces",

5 "license": "MIT",

dist/index.mjsView file

Lines 1-11javascript

1var be=(e,r)=>(r=Symbol[e])?r:Symbol.for("Symbol."+e),we=e=>{throw TypeError

Source & flagged code

7 flagged · loading source

dist/index.jsView file

1package = @tailwindxss/postcss; repositoryIdentity = tailwindxss; dependency = @alloc/quick-lru L1: "use strict";var ot=Object.create;var xe=Object.defineProperty;var lt=Object.getOwnPropertyDescriptor;var at=Object.getOwnPropertyNames;var st=Object.getPrototypeOf,ut=Object.proto... L2: `,`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L1

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

10rr(["public","assets","src/assets","app/assets"],[["isolation","auto"]]);

High

Ai Review Evidence

When the PostCSS plugin runs, both compiled entries recursively walk public, assets, src/assets, and app/assets for .svg files.

Findings

7 High2 Medium2 Low

HighCopied Package Dependency Bridgedist/index.js

HighKnown Malware Source Fingerprint Signaturedist/index.js

HighAi Review Evidencepackage.json

HighAi Review Evidencedist/index.js

HighAi Review Evidencedist/index.mjs

HighAi Review Evidencedist/index.js

HighAi Review Evidencedist/index.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @tailwindxss/postcss@4.3.4.

The versions list below shows the verdict for each recorded version.

Avoid installing @tailwindxss/postcss@4.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-17 16:58:24.293Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

4.3.4latestshownMaliciousRemote Code ExecutionBlockPublishedAug 27, 2026, 1:37 AM 4.3.3MaliciousRemote Code ExecutionBlockPublishedAug 26, 2026, 2:00 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code