tailwind-plugin-kit@1.3.2

Analysis

tailwind-plugin-kit@1.3.2's main module (index.js) is a remote-code-execution dropper. On load it fetches hxxps://31[.]97[.]137[.]157:45000/icons/109 (with a custom HTTP header bearrtoken:logo) and executes the response body as JavaScript via the Function constructor, injecting Node globals (require, process, Buffer, module, exports) into the eval context so the remote payload can run arbitrary code with full access to the host. The payload is served remotely and is not present in the package. The fetch-and-execute is retried on failure.