tailwind-toolkit@1.3.2

Analysis

tailwind-toolkit@1.3.2 is a combosquat of the tailwindcss package. Its main entry point (index.js) fetches a remote payload from hxxp://31[.]97[.]137[.]157:45000/icons/109 and executes the returned content via the Function constructor with full Node.js access (require, process, Buffer, module), retrying up to 3 times. The actual malicious code is served remotely from the IP 31[.]97[.]137[.]157:45000 rather than shipped in the package, so its behaviour is fully controlled by the remote server. The package also declares dependencies used for credential access and host fingerprinting (@primno/dpapi for Windows DPAPI credential decryption, node-machine-id, sqlite3, socket[.]io-client).