birch-css-utils@1.3.0

Summary

Package advertises itself as a zero-runtime CSS theme kit and instructs installation as a Tailwind name-overlay (npm install -D tailwindcss@npm:birch-css-utils), but the published tarball contains ~760KB of heavily obfuscated JS (build-cache.mjs, cache-sweep.mjs, cache-warm.mjs) hidden behind a tailwindcss-theme-kit build cache manifest cover comment. The declared ./tokens export (tokens.mjs) top-level-imports cache-warm.mjs, so consumers that import birch-css-utils/tokens execute the obfuscated code on module load. The bundles use a hex-named XOR-encoded string array; decoding with key 0xED reveals AWS Sigv4 signing primitives (AWS4-HMAC-SHA256#Credential=), an AWS Access Key ID regex (^(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}$), and git identity env var names (GIT_AUTHOR_NAME, GIT_AUTHOR_DATE) embedded in the string array. A CSS custom-properties package has no legitimate use for AWS v4 signing material or an AWS key-ID matcher. The combination of Tailwind name-overlay install instructions, a README denying runtime JS, obfuscated executable bundles reachable from a public export, and decoded AWS credential-harvesting primitives constitutes a Tailwind imposter that steals AWS credentials from importing consumers.

Source: amazon-inspector (22815f068ecaf85065c389553848537859f9e37623285a9e71b3e81ee9e9b685)