OpenSSF/OSV advisory MAL-2026-14189 confirms this npm version as malicious. Package is presented as a Tailwind CSS utility, but its default export `getPlugin` fetches JSON from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109) and passes the returned `data.credits` field to `new Function(...)` bound with `require`, `process`, `module`, and `Buffer`, then invokes it...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-extension-kit (npm)
Details
Package is presented as a Tailwind CSS utility, but its default export `getPlugin` fetches JSON from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109) and passes the returned `data.credits` field to `new Function(...)` bound with `require`, `process`, `module`, and `Buffer`, then invokes it. Following the README's instruction to register the default export as a Tailwind plugin causes Tailwind to invoke `getPlugin`, executing attacker-controlled JavaScript with full Node.js capabilities on the developer's machine. Cover-story framing (variables named `IconProvider`/`iconDomain`, a CDN hostname map for cloudflare/fastly/akamai/cloudfront, a `/ajax/libs/font-awesome/...` path fragment, a `bearrtoken: "logo"` header, and an unused `setDefaultModule` decoy) masks the loader as icon retrieval. Declared runtime dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with browser-credential and cookie-stealer payloads that the fetched code can deploy.
Decision reason
OpenSSF Malicious Packages via OSV confirms tailwind-extension-kit@1.3.2 as malicious (MAL-2026-14189): Malicious code in tailwind-extension-kit (npm)