noelc-css-blender@1.1.0
This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe visible API matches the package description, and inspection found no confirmed attack sink. The unusually large obfuscated initialization remains unexplained, so this warrants a warning rather than a clean verdict or a block.
Decision evidence
public snapshot- The manifest points consumers to index.mjs and declares no lifecycle scripts.
- The entrypoint contains an encoded-string decoder and a large obfuscated prelude before the utility exports.
- The prelude performs opaque string and numeric calculations during module initialization; their purpose is unexplained.
- The visible exports implement token-map merging and CSS-variable formatting.
- The inspected source shows no concrete network, file, process, or dynamic-code execution behavior.
- The manifest and visible exports are consistent with a CSS token utility.
Source & flagged code
4 flaggedThe manifest points consumers to index.mjs and declares no lifecycle scripts.
package.jsonView on unpkg · L1The entrypoint contains an encoded-string decoder and a large obfuscated prelude before the utility exports.
index.mjsView on unpkg · L2Findings
Affected versions and remediation
This report applies to noelc-css-blender@1.1.0.
See all versions of noelc-css-blender for other recorded verdicts.
- Review the evidence and your use of noelc-css-blender@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.