Summary
Togoder Security scanned the npm package @tailwindcss/oxide@4.3.3 on Oct 6, 2026. An AI review of 1 source file produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Dynamic module loading from environment variable
NPS-EDFF0BEB5E2B
The requireNative() function loads a native .node binding from an arbitrary path specified in the NAPI_RS_NATIVE_LIBRARY_PATH environment variable. If an attacker can control that environment variable, they can force the package to load an arbitrary native library, leading to code execution.
Filesystem access outside package scope
NPS-8B009A7200B0
Reads /usr/bin/ldd from the host filesystem at import time for musl detection. This is a read-only probe of a standard system binary and is not itself exfiltration, but it is host filesystem access performed during module initialization.
Shell command execution at import time
NPS-229BEC2E09F3
isMuslFromChildProcess executes 'ldd --version' via child_process.execSync at module load time on Linux to detect musl libc. This is legitimate musl-detection logic but still represents a process spawn happening as a side-effect of importing the module.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | This is an auto-generated NAPI-RS loader for the @tailwindcss/oxide native binding; it performs platform detection and dynamic native/WASI binding loading, with no signs of exfiltration, credential harvesting, obfuscation, or backdoor behavior, but it does load native code paths from an environment variable and executes shell/read commands at import time. |
Scanned versions of @tailwindcss/oxide
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 4.3.3 | Needs review | 1 | Oct 6, 2026 |
Frequently asked questions
Is @tailwindcss/oxide safe to use?
No confirmed malware was found in @tailwindcss/oxide@4.3.3, but the review flagged 1 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does @tailwindcss/oxide contain malware?
No malware was identified in @tailwindcss/oxide@4.3.3 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @tailwindcss/oxide checked?
Togoder Security downloaded the published npm package and had an AI model read its 1 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @tailwindcss/oxide together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @tailwindcss/oxide@4.3.3, cost nothing.