tailwindcss-form-components @1.5.1

Summary

index.js exposes getPlugin(), which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits field to new Function(...) with require , module , process , and Buffer injected — giving the remote endpoint full Node.js execution privileges on the consumer's host. The destination URL is assembled from split string fragments (protocol/separator/domain/path) and framed with icon/CDN-style naming ( iconDomain , bearrtoken: 'logo' , path segment icons/ ), while a separate setDefaultModule function references a benign-looking cdnjs/font-awesome URL as a decoy. The package name typosquats the tailwindcss ecosystem, and declared dependencies include @primno/dpapi, better-sqlite3, and node-machine-id — libraries associated with Windows credential/DPAPI access, browser SQLite database reads, and host fingerprinting. The transport is plain HTTP to a bare IP with no integrity check, so the executed payload is attacker-controlled and mutable.

Source: amazon-inspector (ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac)