Malicious code in tailwind-plugin-kit (npm)

The npm package tailwind-plugin-kit was distributed with embedded malicious code designed to execute arbitrary JavaScript on developer machines. The package masquerades as a legitimate Tailwind CSS plugin toolkit but contains a getPlugin function that performs an HTTPS request to a hardcoded bare-IP endpoint (31.97.137.157:45000/icons/109) during plugin initialization.\n\nWhen a developer follows the package README and registers it as a Tailwind plugin, the malicious code executes with full Node.js context, including access to require, module, exports, process, Buffer, globalThis, and Promise. The response from the attacker-controlled endpoint is passed to new Function(...) for execution, allowing arbitrary code execution on the build machine.\n\nThe package declares dependencies on @primno/dpapi, better-sqlite3, and node-machine-id, consistent with a second-stage infostealer payload targeting browser credential stores and machine identifiers. The code also contains decoy references to well-known CDN hostnames (Cloudflare, Fastly, Akamai, CloudFront) to obscure the actual malicious network destination.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.