process-tailwind@1.1.99

Summary

On require/import, index.js unconditionally calls initialize(), which spawns a detached, unref'd node loader.js child with stdio ignored and writes a PID file. loader.js fetches JSON from https://api.npoint.io/24c25d5f5fcbb0992a4f (a mutable third-party paste endpoint), base64-decodes the code field, and executes it via new Function('require','__dirname','__filename','module','exports', decodedCode)(...), granting the remote endpoint operator arbitrary code execution on the installer's host. The remote URL is stored in a constant misleadingly named API_KEY and surrounded by comments describing the loader as a sandboxed educational component, contradicting the actual fetch-decode-eval behavior.

Source: amazon-inspector (d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432)