GCVE-110-OSM-2026-11637

The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js, writes it to./inout.js, and require()s it every time a consumer imports the package. The fetched content is unpinned, unverified, and served over cleartext HTTP, giving the operator of that IP (and any on-path attacker) arbitrary code execution on the installer's machine at import time. The package name and repository metadata impersonate the official @tailwindcss/aspect-ratio plugin (repository points at tailwindlabs/tailwindcss-aspect-ratio), providing cover for the loader; the remote fetch has no relationship to any Tailwind plugin functionality. Judge assessment: This is a loader-style supply-chain implant that impersonates the Tailwind aspect-ratio plugin while unconditionally fetching and executing remote code from a hardcoded bare IP, giving the operator of 23.27.245.100 arbitrary code execution on the consumer's machine at import time. The entrypoint in src/index.js performs `https.get(url, ...)`, writes the response to `./inout.js`, and immediately `require(output)`, with `url="http://23.27.245.100/index.js"` using cleartext HTTP and no verification. The attacker model is a compromised or malicious npm publisher using typosquatting/brand impersonation to deliver a remote-code loader, which is strongly corroborated by the metadata and OSV advisory. The Tailwind plugin code is a decoy; the network fetch is unrelated to the legitimate aspect-ratio functionality and the IP is classified as custom C2/exfil. ENTRY src/index.js (main: src/index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in src/index.js: "https.get(" - Suspicious Domain in src/index.js: "http://23.27.245.100" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES src/index.js