Malicious code in tailwindcss-3d-styles (npm)

The tailwindcss-3d-styles npm package (version 1.2.4) includes a malicious main entry point that downloads a JavaScript file from an unencrypted HTTP endpoint (http://23.27.245.100:3000/index.js) when required. It writes the fetched code to a local file (./inout.js) and then requires it, resulting in execution of arbitrary code controlled by the remote host. The package uses the legitimate tailwindcss-3d library code as a cover, while the published package name differs from the upstream project, indicating a supply chain compromise or malicious repackaging.

Any Node.js application that installs and imports tailwindcss-3d-styles version 1.2.4 is at risk of remote code execution due to the package's behavior of fetching and executing code from an attacker-controlled server. This can lead to full compromise of the application environment, data theft, or further malicious activity. There are no known exploits in the wild reported at this time.

No official patch or remediation is provided in the available data. Users should immediately remove the tailwindcss-3d-styles package version 1.2.4 from their projects and avoid using this package. Verify dependencies and replace with the legitimate tailwindcss-3d library or other trusted alternatives. Monitor for any unauthorized code execution and audit supply chain dependencies carefully.