@tailwind-core/vite

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1f9a00740b85c3ce7b36a9ba242f3eccc9ebf3d4f626ab911342c50d63b48805)
The package name @tailwind-core/vite impersonates the official @tailwindcss/vite plugin from tailwindlabs, and its package.json declares three dependencies — @tailwind-core/node@4.3.0, tailwind-core@4.3.0, and @tailwind-core/oxide@4.3.0 — that mirror the official @tailwindcss/node, tailwindcss, and @tailwindcss/oxide packages. The README copies Tailwind branding, including a logo srcset pointing at tailwindlabs/tailwind-core, but the repository is owned by an unrelated account (QaLemos), not tailwindlabs. While dist/index.mjs in this tarball appears to be a copy of the legitimate Tailwind Vite plugin with no overt payload, installing this package silently pulls in three sibling typosquatted packages under the same attacker-controlled namespace. A developer who mistypes the official scope and runs `npm install @tailwind-core/vite` ends up with attacker-controlled code from the sibling packages in their dependency tree.

Compromised versions (1)

• 4.3.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.