twcompose-utils@0.7.6

Analysis

twcompose-utils is a combosquat impersonating the @tailwindcss/typography plugin for Tailwind CSS. Its src/index.js exports the legitimate plugin code normally, but appends an obfuscated payload (javascript-obfuscator) that runs 100ms after the module is required. The payload detects the operating system (Windows/macOS/Linux) and CPU architecture (amd64/arm64), decrypts a C2 download URL from an embedded encrypted string table, fetches a platform-specific binary via HTTPS (fetch), writes it to a hidden path under the user's home directory, and executes it as a detached, hidden-window process with the full environment inherited. The binary runner has access to all environment variables including any credentials/tokens the user has set.