process-tailwind

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432)
On require/import, index.js unconditionally calls initialize(), which spawns a detached, unref'd `node loader.js` child with stdio ignored and writes a PID file. loader.js fetches JSON from https://api.npoint.io/24c25d5f5fcbb0992a4f (a mutable third-party paste endpoint), base64-decodes the `code` field, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)(...)`, granting the remote endpoint operator arbitrary code execution on the installer's host. The remote URL is stored in a constant misleadingly named `API_KEY` and surrounded by comments describing the loader as a sandboxed educational component, contradicting the actual fetch-decode-eval behavior.

Compromised versions (1)

• 1.1.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.