Malicious code in tailwind-aspect (npm)

The 'tailwind-aspect' npm package (version 0.4.2) unconditionally downloads a JavaScript file from a hardcoded plain-HTTP IP address (http://23.27.245.100/index.js), writes it locally as './inout.js', and requires it on every import. This remote code is unpinned and unverified, enabling the operator of the IP or any on-path attacker to execute arbitrary code on the system importing the package. The package metadata impersonates the official '@tailwindcss/aspect-ratio' plugin to conceal its malicious behavior. The remote fetch is unrelated to any legitimate Tailwind CSS functionality.

Users installing or importing this package version risk arbitrary code execution on their machines due to the unverified, cleartext HTTP download of remote code. This can lead to full compromise of the affected system. The impersonation of a legitimate package increases the likelihood of unsuspecting users installing the malicious package.

No official patch or remediation is currently documented. Users should avoid installing or using 'tailwind-aspect' version 0.4.2. Verify package authenticity by using the official '@tailwindcss/aspect-ratio' plugin from trusted sources. Monitor for vendor advisories for any updates or fixes.