Malicious code in sw-pluginer (npm)

sw-pluginer is an npm package that presents itself as a Tailwind plugin for service worker registration. However, when Tailwind processes its configuration via require('sw-pluginer'), the package reads a URL from a staged file at node_modules/.bin/manifest.json, performs an HTTP GET request to that URL, and passes the response body directly to eval() in the Node build process.\n\nThe staging file is written by a separate dropper component and is deleted after being read, obscuring the payload destination from static inspection of the tarball. The fetched code is neither pinned, hashed, nor signature-verified, and executes in the developer's Node environment at build time rather than in a browser context.\n\nThis mechanism provides arbitrary code execution to whoever controls the staged manifest.json file, compromising the developer machine during the build process. The self-deleting indirection and unauthenticated network-fetched code execution constitute a covert dropper mechanism rather than legitimate service worker registration functionality.\n\nThe package was identified by the OpenSSF malicious packages project.