core-tailwindcss-utility@3.7.1

Analysis

core-tailwindcss-utility@3.7.1 is a combosquat of the tailwindcss package whose main entry point (index.js) is a remote-code-execution dropper. On load it fetches hxxps://31[.]97[.]137[.]157:45000/icons/108 and executes the response body's `credits` field via the Function constructor with full Node.js context (require, process, Buffer, module, globalThis), giving the remotely-served code unrestricted access to the host. The package bundles dependencies consistent with a credential-stealing implant: @primno/dpapi (Windows DPAPI credential decryption), node-machine-id (host fingerprinting), socket[.]io-client (command/control channel), and better-sqlite3/sqlite3 (local database access). C2 endpoint: 31[.]97[.]137[.]157:45000, path /icons/.