registry / tailwind-core / 4.3.2

tailwind-core@4.3.2

A utility-first CSS framework for rapidly building custom user interfaces.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Runtime use of the package can start a delayed C2 loop that fingerprints the host and executes code returned from Google Apps Script. This behavior is unrelated to a Tailwind-style CSS package.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or invoking the package runtime path after the timestamp gate is reached.

Impact

Remote command/code execution plus host/environment disclosure for consuming projects.

Mechanism

time-gated host fingerprinting, C2 polling, and dynamic code execution

Attack narrative

The package's compiled entry files include a hidden delayed function that imports os and crypto, builds a host fingerprint, derives an equipment id, obtains an OAuth access token, registers the host with a Google Apps Script endpoint, then repeatedly polls for base64 JSON instructions. If instructions include code, the package compiles it with new Function and invokes it with helper functions and C2 accessors.

Rationale

Static source inspection confirms concrete malicious behavior: host fingerprint exfiltration and remote code execution through a time-gated C2 loop. Absence of install hooks only narrows activation to runtime/build-time use; it does not make this package safe.

Evidence

package.jsondist/lib.jsdist/lib.mjs

Network endpoints2

oauth2.googleapis.com/tokenscript.googleapis.com/v1/scripts/AKfycbyjrAVcSQB2V6XNzgYK8J0gGyx0c_ZpC0y4rFzq1IGUPu7zx7guLszZDVlcsfDzXVz3QA:run

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/lib.js and dist/lib.mjs contain a time-gated async function that activates after Date.now() >= 1783641600000.
The payload fingerprints host data via os.hostname(), homedir(), platform(), arch(), cpus().length, and totalmem().
Fingerprint data is base64 encoded and sent as equip_desc to a Google Apps Script function named addNewEquipment.
The code exchanges an embedded OAuth refresh token/client secret for an access token at oauth2.googleapis.com/token.
It polls script.googleapis.com/v1/scripts/<script-id>:run every 10 seconds for base64 JSON instructions.
Returned code is installed with new Function and then invoked, enabling remote code execution.

Evidence against

package.json has no npm lifecycle hooks, so behavior is not install-time.
The package also contains normal Tailwind-like CSS compiler code and CSS exports.
No AI-agent control surface writes were found in inspected files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 588 KB of source, external domains: oauth2.googleapis.com, script.googleapis.com, tailwind-core.com

Source & flagged code

6 flagged

dist/lib.mjsView file

Lines 1-29javascript

1import{a as nt,b as L,c as Z,d as or,e as I,f as Et,g as te,h as lt,i as ur}from"./chunk-TDNFF6A4.mjs";import{a as sr}from"./chunk-X4GG3EDV.mjs";import{a as Pe,b as _e,c as ar}from"./chunk-5JIJA4QV.mjs";import{a as Nt}from"./chunk-3SAEGOMQ.mjs";var fr="4.3.2";function at(e){let r=[0];for(let n=0;n<e.length;n++)e.charCodeAt(n)===10&&r.push(n+1);function i(n){let s=0,l=r.length;for(;l>0;){let u=(l|0)>>1,f=s+u;r[f]<=n?(s=f+1,l=l-u-1):l=u}s-=1;let c=n-r[s];return{line:s+1,column:c}}function t({line:n,column:s}){n-=1,n=Math.min(Math.max(n,0),r.length-1);let l=r[n],c=r[n+1]??l;return Math.min(Math.m ...

2`,`

3`);let r=[],i=[],t=null,n="",s;for(let l=0;l<e.length;l++){let c=e.charCodeAt(l);switch(c){case vr:{n+=e[l]+e[l+1],l++;break}case cn:{if(n.length>0){let f=ae(n);t?t.nodes.push(f):r.push(f),n=""}let u=ae(e[l]);t?t.nodes.push(u):r.push(u);break}case wr:case yr:case br:case kr:case xr:case Ar:case Cr:case $r:{if(n.length>0){let d=ae(n);t?t.nodes.push(d):r.push(d),n=""}let u=l,f=l+1;for(;f<e.length&&(s=e.charCodeAt(f),!(s!==wr&&s!==yr&&s!==br&&s!==kr&&s!==xr&&s!==Ar&&s!==Cr&&s!==$r));f++);l=f-1;let m=an(e.slice(u,f));t?t.nodes.push(m):r.push(m);break}case fn:case sn:{let u=l;for(let f=l+1;f<e.leng ...

4`,r){i+=f.length;let m=i;i+=l.property.length,i+=2,i+=l.value?.length??0,l.important&&(i+=11);let d=i;i+=2,l.dst=[t,m,d]}}else if(l.kind==="rule"){if(u+=`${f}${l.selector} {

5`,r){i+=f.length;let m=i;i+=l.selector.length,i+=1;let d=i;l.dst=[t,m,d],i+=2}for(let m of l.nodes)u+=n(m,c+1);u+=`${f}}

6`,r&&(i+=f.length,i+=2)}else if(l.kind==="at-rule"){if(l.nodes.length===0){let m=`${f}${l.name} ${l.params};

7`;if(r){i+=f.length;let d=i;i+=l.name.length,i+=1,i+=l.params.length;let p=i;i+=2,l.dst=[t,d,p]}return m}if(u+=`${f}${l.name}${l.params?` ${l.params

8`,r){i+=f.length;let m=i;i+=l.name.length,l.params&&(i+=1,i+=l.params.length),i+=1;let d=i;l.dst=[t,m,d],i+=2}for(let m of l.nodes)u+=n(m,c+1);u+=`${f}}

9`,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/

10`,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let

11Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/lib.mjsView on unpkg · L1

High

Eval

Package source references dynamic code evaluation.

dist/lib.mjsView on unpkg · L9

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/lib.mjsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib.mjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.mjs

12`);let f=u.value,m=structuredClone(l),d="\xB6";D(m.nodes,y=>{if(y.kind==="word"&&y.value===f)return E.ReplaceSkip({kind:"word",value:d})});let p="^".repeat(q([u]).length),v=q([m]).indexOf(d),h=["```css",q([l])," ".repeat(v)+p,"```"].join(`

13`);console.warn(h)}}),n.value=q(s)}),i.utilities.functional(r.slice(0,-2),n=>{let s=re(e),l=n.value,c=n.modifier,u=!1,f=!1,m=!1,d=!1,p=new Map,v=!1;if(D([s],(h,y)=>{let b=y.parent;if(b?.kind!=="rule"&&b?.kind!=="at-rule"||h.kind!=="declaration"||!h.value)return;let N=!1,x=F(h.value);if(D(x,A=>{if(A.kind==="function"){if(A.value==="--value"){u=!0;let $=Kr(l,A,i);return $?(f=!0,$.ratio?v=!0:p.set(h,b),E.ReplaceSkip($.nodes)):(N=!0,E.Stop)}else if(A.value==="--modifier"){m=!0;let $=Kr(c,A,i);return $?(d=!0,E.ReplaceSkip($.nodes)):(N=!0,E.Stop)}}}),N)return E.ReplaceSkip([]);h.value=q(x)}),!u||!f| ...

14`,`

15`);let r=[],i=[],t=null,n="",s;for(let l=0;l<e.length;l++){let c=e.charCodeAt(l);switch(c){case ii:case ni:case li:case ui:case si:case fi:case ci:{if(n.

16`),s=!0;return D(F(t),l=>{if(l.kind==="function"&&l.value==="var"){let c=l.nodes[0].value;if(!new RegExp(`var\\(${c}[,)]\\s*`,"g").test(n)||n.includes(`${c}:`))return s=!1,E.Stop}}),s}function Nl(e,r){if(e.kind!=="functional"||e.value?.kind!=="named")return e;let i=r.designSystem,t=i.storage[Qt].get(r.signatureOptions),n=i.storage[ve].get(r.signatureOptions),s=i.storage[tt].get(r.signatureOptions),l=i.printCandidate(e),c=n.get(l);if(typeof c!="string")return e;for(let f of u(c,e))if(s(e,f))return f;return e;function*u(f,m){let d=t.get(f);if(d.length>1){let p;for(let v of d)if(v[0]!=="-"){if(p) ...

18${ne([d])}

19Relies on:

21${ne([v])}`)}f.add(d);for(let v of s.get(d))for(let h of l.get(v))p.push(d),m(h,p),p.pop();c.add(d),f.delete(d),u.push(d)}}for(let d of n)m(d);for(let d of u)

23${ne([b])}

25\`@plugin\` options must be a flat list of declarations.`);if(b.value===void 0)continue;let N=b.value,x=L(N,",").map(A=>{if(A=A.trim(),A==="null")return null;if(A==="true"

27Using an object as a plugin option is currently only supported in JavaScript configuration files.`)}else return Number(A);return A});y[b.property]=x.length===1?x[0]:x}return l.push([{id:h,base:v.context.base,reference:!!v.context.reference,src:d.src},Object.keys(y).length>0?y:null]),s|=4,E.Replace([])}if(d.name==="@config"){if(d.nodes.length>0)throw new Error("`@config` cannot have a body.");if(v.parent!==null)throw new Error("`@config` cannot be nested.");return c.push({id:d.params.slice(1,

29${JSON.stringify(y,null,2)}

Long lines were clipped for display.

dist/lib.jsView file

•Trigger-reachable chain: manifest.exports -> dist/lib.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lib.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/lib.mjsView file

1import{a as nt,b as L,c as Z,d as or,e as I,f as Et,g as te,h as lt,i as ur}from"./chunk-TDNFF6A4.mjs";import{a as sr}from"./chunk-X4GG3EDV.mjs";import{a as Pe,b as _e,c as ar}from... L2: `,` ... L9: `,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/ L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return... L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/lib.mjsView on unpkg · L1

9`,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/ L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return... L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.

High

Eval

Package source references dynamic code evaluation.

dist/lib.mjsView on unpkg · L9

1import{a as nt,b as L,c as Z,d as or,e as I,f as Et,g as te,h as lt,i as ur}from"./chunk-TDNFF6A4.mjs";import{a as sr}from"./chunk-X4GG3EDV.mjs";import{a as Pe,b as _e,c as ar}from... L2: `,` ... L9: `,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/ L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return... L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/lib.mjsView on unpkg · L1

1import{a as nt,b as L,c as Z,d as or,e as I,f as Et,g as te,h as lt,i as ur}from"./chunk-TDNFF6A4.mjs";import{a as sr}from"./chunk-X4GG3EDV.mjs";import{a as Pe,b as _e,c as ar}from... L2: `,` ... L9: `,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/ L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return... L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib.mjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.mjsView on unpkg · L9

dist/lib.jsView file

•Trigger-reachable chain: manifest.exports -> dist/lib.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lib.jsView on unpkg

Findings

2 Critical4 High3 Medium4 Low

CriticalRemote Asset Decode Executedist/lib.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/lib.js

HighChild Process

HighEvaldist/lib.mjs

HighHost Fingerprint Exfiltrationdist/lib.mjs

HighSandbox Evasion Gated Capabilitydist/lib.mjs

MediumDynamic Requiredist/lib.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings