GCVE-110-OSM-2026-11648

The package's main entry point fetches a JavaScript file from http://23.27.245.100:3000/index.js over plain HTTP at require time, writes the response to./inout.js in the current working directory, and require()s the resulting file — causing arbitrary code from that host to execute in the Node process of any consumer importing this package. The remaining code is a copy of the legitimate `tailwindcss-3d` library (per the manifest's repository/homepage), and the published name `tailwindcss-3d-styles` differs from the upstream `tailwindcss-3d`, using the upstream library as cover for the appended dropper. Judge assessment: This is a clear supply-chain dropper: the package’s entrypoint in `index.js` fetches remote JavaScript from `http://23.27.245.100:3000/index.js`, writes it to `./inout.js`, and immediately `require()`s it, which executes attacker-controlled code in the consumer’s Node process. The attacker model is a compromised or malicious publisher using a legitimate-looking Tailwind plugin as cover to deliver arbitrary code from a custom C2 host; the rest of the file is a copied `tailwindcss-3d` implementation to disguise the payload. The plain-HTTP IP-based fetch, dynamic `require(output)`, and the IOC classification of `23.27.245.100` as `custom-c2` corroborate malicious intent. The new publisher account and brand-new package further support a deliberate one-off malicious release rather than a normal library. ENTRY common/index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "https.get(" - Suspicious Domain in index.js: "http://23.27.245.100" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js