core-tailwindcss-utility version 3.7.1 is a malicious npm package that pretends to be a Tailwind CSS utility but contains no CSS functionality. Its index.js exports a getPlugin() function that fetches JSON data from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/108). It extracts the 'credits' field from the response and executes it as Node.js code using new Function(), with require, process, and Buffer objects bound in scope. The package uses a decoy function to construct URLs resembling legitimate CDN providers to disguise its true purpose. Declared dependencies such as @primno/dpapi, better-sqlite3/sqlite3, node-machine-id, socket.io-client, and axios are inconsistent with a CSS utility and enable browser credential decryption and remote command-and-control capabilities. This setup allows the attacker to run arbitrary code on the host system, potentially compromising sensitive data and system integrity.

The malicious package enables remote code execution on the host system by dynamically evaluating attacker-controlled code fetched from a remote server. This can lead to unauthorized access, credential theft, and persistent remote control of the affected system. The inclusion of dependencies related to credential decryption and remote communication increases the risk of sensitive data compromise and further exploitation. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing or using core-tailwindcss-utility version 3.7.1 from untrusted sources. Remove any existing installations of this package from your environment. Use trusted and verified packages from official repositories. Monitor for any suspicious activity related to this package and conduct a thorough security review if it has been installed.