The tailwind-toolkit package (npm ecosystem) version 1.3.2 contains malicious code that, upon registration in tailwind.config, issues an HTTPS request to a hardcoded bare IP address (31.97.137.157:45000/icons/109). The response's 'credits' field is executed as code within the installer's Node.js process using 'new Function', allowing fully attacker-controlled code execution. The package declares dependencies such as @primno/dpapi, better-sqlite3/sqlite3, and node-machine-id, indicating the payload is designed to steal browser credentials, including decrypting Windows DPAPI credentials and accessing browser cookie and login data. The remote host and executed payload are unrelated to the package's advertised Tailwind CSS plugin functionality, representing a supply chain compromise and malicious package distribution.

Users installing tailwind-toolkit version 1.3.2 risk executing arbitrary attacker-controlled code within their Node.js environment. This can lead to theft of sensitive browser credentials, including decrypted Windows DPAPI credentials and browser login data. The malicious payload is delivered from a hardcoded IP address and executed dynamically, enabling full remote control by the attacker. This compromises user security and privacy, potentially leading to credential theft and further system compromise.

No official patch or remediation guidance is currently provided. Users should immediately avoid installing or using tailwind-toolkit version 1.3.2. Remove the package from any projects and replace it with a trusted alternative. Monitor for any suspicious activity related to credential theft. Check vendor advisories or npm security advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.