tailwind-core@4.3.0

Analysis

tailwind-core@4.3.0 is a combosquat of the legitimate tailwindcss CSS framework, published by a known supply-chain attacker account. The package ships a functional CSS compiler as cover but contains a base64 decoding function (Buffer.from base64 to string) paired with a new Function(code) call that evaluates decoded content — a dormant eval-decoder channel for executing hidden payloads. The package is published under the name tailwind-core to trick developers mistyping tailwindcss, on a GitHub repository at github[.]com/QaLemos/tailwind-core.git — an unaffiliated user, not the official tailwindlabs organization.