sw-pluginer@1.1.0

Analysis

sw-pluginer@1.1.0 is a remote code execution dropper disguised as a Tailwind CSS service-worker plugin. The data flow: index.js reads a URL from node_modules/.bin/manifest.json (an unusual trigger-file location), manifest-reader.js immediately deletes that file (fs.unlinkSync — anti-forensic), worker-fetcher.js fetches arbitrary code from the URL, and register-worker.js calls eval(workerCode) on the fetched content — executing it in the Node.js build process. The eval serves no legitimate purpose: the returned registration snippet is a static template string that does not use the eval'd code at all. The comment "safe, no eval" directly preceding the eval() call is deceptive. This is a dormant second-stage loader that activates when a trigger manifest file is planted, executing arbitrary attacker-controlled remote code. No lifecycle hooks are needed — the code runs when the Tailwind plugin is loaded during build. The first agent incorrectly assessed the eval as serving a functional purpose; it does not. Evidence: remote fetch-and-eval, anti-forensic file deletion, deceptive comments, trigger-file pattern, protonmail publisher.