Malicious code in core-tailwindcss-utility (npm)

core-tailwindcss-utility is a malicious npm package that masquerades as a Tailwind CSS utility library but contains no actual CSS utilities. Instead, its index.js exports a getPlugin() function that fetches JSON from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/108) and executes the response's credits field as arbitrary Node.js code using new Function(...) with access to require, process, and Buffer.\n\nThe package includes a decoy setDefaultModule() function that constructs CDN URLs (cloudflare.com, fastly.net) to disguise itself as a font-awesome or CDN helper, but the actual invoked path targets the bare-IP command-and-control server. The declared dependencies—@primno/dpapi (Windows DPAPI decryption), better-sqlite3/sqlite3, node-machine-id, socket.io-client, and axios—are inconsistent with any legitimate Tailwind purpose and pre-stage the infrastructure for credential theft and remote C2 communication.\n\nThe package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. Any system that installs and uses this package would execute attacker-controlled code with full Node.js privileges, enabling credential theft, data exfiltration, and further compromise.