registry / tailwind-plugin-kit / 1.3.2

tailwind-plugin-kit@1.3.2

Tailwind CSS utilities and reusable components.

AI Security Review

scanned 23h ago · by lpm-firewall-ai

Invoking the exported plugin fetches attacker-controlled JSON from a hard-coded IP address and executes its credits field as Node.js code. The payload receives process, global, Buffer, and require.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer invokes the default-exported plugin, such as through Tailwind configuration processing.

Impact

Remote code can act with the invoking Node process's permissions.

Mechanism

remote payload execution through Function(data.credits)

Attack narrative

A project that configures and invokes this purported Tailwind plugin causes index.js to request a payload from the hard-coded IP endpoint. It reads data.credits from the JSON response, constructs a Function from it, and invokes that function with require, process, global, and Buffer. The remote operator can therefore supply arbitrary Node.js code under the consumer's privileges.

Rationale

This is a concrete remote-code-execution loader disguised as a Tailwind plugin. Absence of an install hook limits the trigger but does not mitigate execution when the exported plugin is used.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

31.97.137.157:45000/icons/109

OSV Corroboration

OpenSSF/OSV

The package presents itself as a Tailwind CSS plugin toolkit but its exported `getPlugin` function performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109) and passes the response's `data.credits` field to `new Function(...)` with a full Node.js execution context (require, module, exports, process, Buffer, globalThis, Promise). Any project following the README instructions and registering the package as a Tailwind plugin (`plugins: [toolkit]`) triggers execution of arbitrary attacker-controlled JavaScript on the developer/build machine. The destination URL is assembled by concatenating separate protocol/domain/path fragments, and the file also contains an unused `setDefaultModule` referencing well-known CDN hostnames (cloudflare, fastly, akamai, cloudfront) as a decoy — the actual network destination is the bare IP, not any CDN. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with a second-stage infostealer payload targeting browser credential stores and machine identifiers on the loaded host.

tailwind-plugin-kit@1.3.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code