tailwindcss-form-components@1.5.0

Analysis

tailwindcss-form-components is a combosquat package impersonating the Tailwind CSS ecosystem. Its index.js hardcodes a C2 server at IP 46[.]183[.]25[.]232:45000 and fetches a payload from the path /icons/106. The fetched response is executed via new Function() with the full Node.js runtime context (require, process, Buffer, module, etc.) injected, giving the remote attacker arbitrary code execution on the victim's machine. The package depends on node-machine-id (host fingerprinting), better-sqlite3 and sqlite3 (local database access), socket[.]io-client (real-time C2 channel), and axios/request (HTTP exfiltration). The README links to an unrelated GitHub repository as cover.