Invoking the plugin can turn a project-local manifest path into remote JavaScript execution in the build process. The manifest is also deleted after use.
Static reason
No blocking static signals were detected.
Trigger
A build tool invokes the exported `swCachePlugin` function while `node_modules/.bin/manifest.json` exists.
Impact
Arbitrary code execution with the permissions of the build process.
Mechanism
manifest-controlled HTTP(S) fetch followed by eval
Attack narrative
A project-local manifest supplies a URL. When the Tailwind plugin runs, it fetches JavaScript from that URL and directly evaluates the response in the build process. There is no origin restriction, signature, or integrity validation; the manifest is then deleted, reducing forensic evidence.
Rationale
The package contains a concrete remote-code-execution chain, not merely a service-worker registration helper. Absence of install hooks does not mitigate execution when the plugin is used.
Evidence
index.jslib/manifest-reader.jslib/worker-fetcher.jslib/register-worker.jsnode_modules/.bin/manifest.json