registry / @tailwindxss/postcss / 4.3.3

@tailwindxss/postcss@4.3.3

PostCSS plugin for Tailwind CSS, a utility-first CSS framework for rapidly building custom user interfaces

AI Security Review

scanned 3h ago · by lpm-firewall-ai

During a PostCSS build, the package scans common project asset directories and executes base64 content hidden in SVG comments. This is arbitrary code execution controlled by project files.

Static reason

One or more suspicious static signals were detected.

Trigger

Import and run the PostCSS plugin on a stylesheet containing a recognized Tailwind directive.

Impact

Arbitrary code executes with the build process permissions.

Mechanism

SVG-comment payload decoding followed by dynamic async-function execution

Attack narrative

The plugin's Once hook invokes a helper that recursively enumerates SVG files in common project asset directories. For each SVG it reads an HTML comment, base64-decodes its contents, constructs an async function from that string, and immediately invokes it. A malicious SVG placed in the project can therefore execute arbitrary code whenever the PostCSS/Tailwind build runs.

Rationale

The concealed SVG-comment payload loader and immediate dynamic execution are unrelated to normal PostCSS processing and provide a concrete arbitrary-code-execution path.

Evidence

package.jsondist/index.jsdist/index.mjspublic/**/*.svgassets/**/*.svgsrc/assets/**/*.svgapp/assets/**/*.svg

Decision evidence

public snapshot

with false-positive risk.

@tailwindxss/postcss@4.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code