Malicious code in daisypick (npm)

The 'daisypick' npm package masquerades as a Tailwind CSS helper but includes a malicious 'plugin' export that reads a URL from a local manifest file, fetches JavaScript code from that URL without verification, deletes the manifest file, and executes the fetched code in the Node.js process. The Function constructor used to execute the code is obfuscated by reconstructing the string 'constructor' at runtime using color utility naming to evade static detection. This results in arbitrary remote code execution on the build machine whenever Tailwind builds run with this plugin.

Any system with the 'daisypick' package installed and using the 'daisypick/plugin' in Tailwind CSS builds is at risk of full compromise. The attacker can execute arbitrary code remotely, potentially gaining full control over the build environment. All secrets and keys stored on the compromised machine should be considered exposed and require immediate rotation. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently available. The package should be removed immediately from all environments. Developers should avoid using 'daisypick/plugin' in Tailwind configurations. All secrets and credentials on affected machines should be rotated from a secure, uncompromised system. Monitor for any signs of compromise and consider rebuilding affected systems to ensure removal of any persistent malicious code.