tailwindcss-devtools@1.4.0

Analysis

This package is a combosquat on the Tailwind CSS ecosystem (tailwindcss-devtools). Its entry point (package/index.js), when required, automatically fetches a second-stage payload from bet[.]slotgambit[.]com/icons/<token> via the fetch() API and executes the response through new Function() with full access to Node.js built-ins (require, process, console, Buffer). This gives the remote server arbitrary code execution on the installer's machine. The package also depends on tailwindcss-popups (a known malicious package), node-machine-id (device fingerprinting), and socket[.]io-client. The C2 host is bet[.]slotgambit[.]com.