tailwind-typography-plus@2.1.0

Analysis

tailwind-typography-plus@2.1.0 masquerades as a Tailwind typography plugin and steganographically encodes a payload inside font-metrics.json as font-metric ratio arrays. On require, index.js decodes the ratios back to bytes and executes them via new Function('require','process','Buffer','console', source), granting full Node.js API access to the decoded code with no lifecycle hook needed. The decoded payload issues a GET request to hxxp://194[.]11[.]226[.]41:4000/d/zRlY7_JxvFY8_Zhhu8ih24iW_dT5Rb_9/agent-linux-amd64 to fetch a second-stage binary. A commented "STEALTH PAYLOAD AREA" marker is left in styles.js.