MAL-2026-16056

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14) The package's main module (src/index.js) performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in the consumer's working directory, and immediately require()s the written file. The fetch is unpinned, unauthenticated, and served from a bare IP over cleartext, so the operator of that endpoint controls arbitrary JavaScript executed in the Node process that loads this package. The package presents itself as the Tailwind aspect-ratio plugin, with a package.json repository field pointing to tailwindlabs/tailwindcss-aspect-ratio, while the dropper is appended after the legitimate-looking plugin export.