The tailwind-extension-kit package (version 1.3.2) is presented as a Tailwind CSS utility but contains malicious code. Its default export function 'getPlugin' fetches JSON data from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109). It then extracts the 'data.credits' field and executes it as JavaScript code using 'new Function(...)' with Node.js context bindings (require, process, module, Buffer). This results in execution of attacker-controlled code with full Node.js capabilities on the developer's machine. The package uses deceptive variable names and CDN hostname mappings to disguise the malicious loader as an icon retrieval mechanism. Declared runtime dependencies align with payloads designed for browser credential and cookie theft.

Successful use of this package as a Tailwind plugin leads to remote code execution on the developer's environment with full Node.js privileges. This can enable theft of sensitive information such as browser credentials and cookies, potentially compromising developer systems and any connected resources. The malicious code is executed silently during normal usage of the package as intended by its README instructions.

No official patch or remediation is currently documented. Users should avoid using tailwind-extension-kit version 1.3.2 and remove it from their projects if present. Verify dependencies for malicious or unexpected code before installation. Monitor vendor advisories or trusted security sources for updates or fixes. Since this is a malicious package, consider reporting it to the npm registry for removal.