GCVE-110-OSM-2026-11898

The package's main module (src/index.js) performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in the consumer's working directory, and immediately require()s the written file. The fetch is unpinned, unauthenticated, and served from a bare IP over cleartext, so the operator of that endpoint controls arbitrary JavaScript executed in the Node process that loads this package. The package presents itself as the Tailwind aspect-ratio plugin, with a package.json repository field pointing to tailwindlabs/tailwindcss-aspect-ratio, while the dropper is appended after the legitimate-looking plugin export. ENTRY src/index.js (main: src/index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in src/index.js: "https.get(" - Suspicious Domain in src/index.js: "http://23.27.245.100" ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES src/index.js