registry / Remote code execution / process-tailwind
process-tailwind
Utilities for working with runtime and system information.
This report shows the evidence for process-tailwind@1.1.99, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis package contains an import-triggered detached remote-code loader, not the runtime utilities claimed by its manifest. The remote payload is executed with Node module access, creating concrete remote code execution.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An application imports process-tailwind or explicitly imports its loader entrypoint.
Impact
Remote code execution in the importing application's user context, with background-process persistence until terminated.
Mechanism
Detached remote payload loader using dynamic function execution.
Attack narrative
A normal import calls initialize, which spawns loader.js detached and suppresses its standard streams. The loader downloads a JSON field named code from api.npoint.io, base64-decodes it, and runs it through new Function while supplying require and local path values. The remote operator can therefore change code executed in every importing application without publishing a new package version. The detached process and PID file keep the loader running independently of the importing process.
AI rationale
This package contains an import-triggered detached remote-code loader, not the runtime utilities claimed by its manifest. The remote payload is executed with Node module access, creating concrete remote code execution.
Evidence
index.jsinit.jsloader.js.pid
Network endpoints1
api.npoint.io/24c25d5f5fcbb0992a4f
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the main entry immediately starts the initializer.
- The initializer launches a detached loader and records its process ID.
- The loader fetches base64 code from a remote endpoint and executes it with Node module access.
- The loader globally intercepts child-process imports and hides Windows child windows.
Evidence against
- The manifest contains no npm preinstall, install, or postinstall hook.
- No credential harvesting or exfiltration is present in the inspected package source.
Behavioral surface
ChildProcessEvalFilesystemNetworkShell
UrlStrings
Source & flagged code
7 flagged · loading sourceinit.jsView file
1import { spawn } from 'child_process';
L2: import { dirname, join } from 'path';
High
1Cross-file remote execution chain: init.js spawns loader.js; helper contains network access plus dynamic code execution.
L1: import { spawn } from 'child_process';
L2: import { dirname, join } from 'path';
...
L5:
L6: const __dirname = dirname(fileURLToPath(import.meta.url));
L7: const PID_FILE = join(__dirname, '.pid');
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
init.jsView on unpkg · L1loader.jsView file
1import https from "https";
L2: import { fileURLToPath } from "url";
...
L7: const __filename = fileURLToPath(import.meta.url);
L8: const __dirname = dirname(__filename);
L9: const require = createRequire(import.meta.url);
...
L12:
L13: // Intercept child_process require calls for Windows compatibility
L14: const originalRequire = Module.prototype.require;
...
L22: module.spawn = function(cmd, args, options = {}) {
L23: if (process.platform === "win32" && !options.windowsHide) {
L24: options.windowsHide = true;
...
L31: const { spawnSync } = require('child_process');
Findings
7 High1 Medium4 Low
HighChild Processinit.js
HighShell
HighSandbox Evasion Gated Capabilityloader.js
HighCross File Remote Execution Contextinit.js
HighKnown Malware Source Similarityloader.js
HighKnown Malware Source Fingerprint Signatureloader.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowEvalloader.js
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to process-tailwind@1.1.99.
The versions list below shows the verdict for each recorded version.
- Avoid installing process-tailwind@1.1.99. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.