registry / Remote code execution / tailwind-core
tailwind-core
A utility-first CSS framework for rapidly building custom user interfaces.
This report shows the evidence for tailwind-core@4.3.2. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection confirms concrete malicious behavior: host fingerprint exfiltration and remote code execution through a time-gated C2 loop. Absence of install hooks only narrows activation to runtime/build-time use; it does not make this package safe.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or invoking the package runtime path after the timestamp gate is reached.
Impact
Remote command/code execution plus host/environment disclosure for consuming projects.
Mechanism
time-gated host fingerprinting, C2 polling, and dynamic code execution
Attack narrative
The package's compiled entry files include a hidden delayed function that imports os and crypto, builds a host fingerprint, derives an equipment id, obtains an OAuth access token, registers the host with a Google Apps Script endpoint, then repeatedly polls for base64 JSON instructions. If instructions include code, the package compiles it with new Function and invokes it with helper functions and C2 accessors.
AI rationale
Static source inspection confirms concrete malicious behavior: host fingerprint exfiltration and remote code execution through a time-gated C2 loop. Absence of install hooks only narrows activation to runtime/build-time use; it does not make this package safe.
Evidence
package.jsondist/lib.jsdist/lib.mjs
Network endpoints2
oauth2.googleapis.com/tokenscript.googleapis.com/v1/scripts/AKfycbyjrAVcSQB2V6XNzgYK8J0gGyx0c_ZpC0y4rFzq1IGUPu7zx7guLszZDVlcsfDzXVz3QA:run
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/lib.js and dist/lib.mjs contain a time-gated async function that activates after Date.now() >= 1783641600000.
- The payload fingerprints host data via os.hostname(), homedir(), platform(), arch(), cpus().length, and totalmem().
- Fingerprint data is base64 encoded and sent as equip_desc to a Google Apps Script function named addNewEquipment.
- The code exchanges an embedded OAuth refresh token/client secret for an access token at oauth2.googleapis.com/token.
- It polls script.googleapis.com/v1/scripts/<script-id>:run every 10 seconds for base64 JSON instructions.
- Returned code is installed with new Function and then invoked, enabling remote code execution.
Evidence against
- package.json has no npm lifecycle hooks, so behavior is not install-time.
- The package also contains normal Tailwind-like CSS compiler code and CSS exports.
- No AI-agent control surface writes were found in inspected files.
Behavioral surface
ChildProcessCryptoDynamicRequireEval
Source & flagged code
6 flagged · loading sourcedist/lib.mjsView file
1import{a as nt,b as L,c as Z,d as or,e as I,f as Et,g as te,h as lt,i as ur}from"./chunk-TDNFF6A4.mjs";import{a as sr}from"./chunk-X4GG3EDV.mjs";import{a as Pe,b as _e,c as ar}from...
L2: `,`
...
L9: `,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/
L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return...
L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/lib.mjsView on unpkg · L19`,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/
L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return...
L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.
High
1import{a as nt,b as L,c as Z,d as or,e as I,f as Et,g as te,h as lt,i as ur}from"./chunk-TDNFF6A4.mjs";import{a as sr}from"./chunk-X4GG3EDV.mjs";import{a as Pe,b as _e,c as ar}from...
L2: `,`
...
L9: `,r&&(i+=f.length,i+=2)}else if(l.kind==="comment"){if(u+=`${f}/*${l.value}*/
L10: `,r){i+=f.length;let m=i;i+=2+l.value.length+2;let d=i;l.dst=[t,m,d],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return...
L11: Only valid data types are: ${Bt.map(y=>`"${y}"`).join(", ")}.
Findings
2 Critical4 High3 Medium4 Low
CriticalRemote Asset Decode Executedist/lib.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/lib.js
HighChild Process
HighEvaldist/lib.mjs
HighHost Fingerprint Exfiltrationdist/lib.mjs
HighSandbox Evasion Gated Capabilitydist/lib.mjs
MediumDynamic Requiredist/lib.mjs
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tailwind-core@4.3.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwind-core@4.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.