The npm package 'tailwind-plugin-kit' version 1.3.2 contains malicious code that executes arbitrary JavaScript on the developer or build machine. The package's exported function makes an HTTPS request to a hardcoded IP address and executes the returned data as code with full Node.js context. This behavior can lead to execution of attacker-controlled code during the build process. The package also includes dependencies consistent with a second-stage infostealer targeting browser credentials and machine identifiers.