Configuring the Tailwind plugin activates a local manifest-to-network-to-eval chain. A manifest-controlled URL supplies code that executes in the build process.
Static reason
No blocking static signals were detected.
Trigger
User invokes the package as a Tailwind plugin during a build.
Impact
Remote code execution with the build process's privileges; deletes the consumed manifest.
Mechanism
Arbitrary manifest URL fetch followed by eval
Attack narrative
When the plugin runs, it reads node_modules/.bin/manifest.json, accepts its path field as a URL, downloads the response, and directly evals it. The README advertises normal plugin use, so this runs during an ordinary configured build rather than an explicit dangerous command. The manifest is then deleted, reducing evidence.
Rationale
The package contains a concrete remote-code-execution chain, not merely service-worker registration logic. The fetched script is executed in Node via eval with no origin or integrity validation.
Evidence
package.jsonindex.jslib/manifest-reader.jslib/worker-fetcher.jslib/register-worker.jsREADME.mdnode_modules/.bin/manifest.json