tailwind-utility-kit @1.3.2

Summary

The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to https://31.97.137.157:45000/icons/109, fetches JSON from that endpoint, and passes the response's credits field to new Function('require','module',...,'Promise', data.credits) , invoking it with require , process , and Buffer . This is arbitrary attacker-controlled code execution on the host that loads the package, with full Node privileges. A decoy setDefaultModule referencing CDN-lookalike domains and a Font Awesome icon path is present as cover-story metadata, and the fragmented URL assembly conceals the bare-IP destination. Declared dependencies ( @primno/dpapi , better-sqlite3 , node-machine-id ) are consistent with a browser-credential-stealer payload delivered via the remote loader.

Source: amazon-inspector (39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff)