# @tailwindcss/oxide-wasm32-wasi@4.3.3 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-06T14:12:22.000Z - Files reviewed: 4 - Findings: 1 high, 8 medium, 6 low severity findings - Report: https://security.togoder.click/npm/@tailwindcss/oxide-wasm32-wasi - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package @tailwindcss/oxide-wasm32-wasi@4.3.3 on Oct 6, 2026. An AI review of 4 source files produced 1 high, 8 medium, 6 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [high] Excessive filesystem preopens Finding ID: `NPS-5F776BEC7CD9` File: `wasi-worker.mjs:34` The WASI instance is configured with preopens mapping the root directory (`__rootDir`) to itself. This gives the WASM module unrestricted access to the entire filesystem, far beyond what is typically necessary, enabling potential data theft or tampering. ### [medium] WASI filesystem preopen of root Finding ID: `NPS-1F0E2B4F1A77` File: `tailwindcss-oxide.wasi-browser.js:17` WASI configuration preopens '/' to '/', granting the virtualized WASM/WASI module access to the entire root of its memfs volume. Combined with the FS proxy worker, filesystem operations could extend beyond the package scope if the sandbox is misconfigured. ### [medium] Dynamic network fetch at import time Finding ID: `NPS-5AFE33496CD5` File: `tailwindcss-oxide.wasi-browser.js:25` The module fetches a remote WASM binary via fetch(__wasmUrl) at top-level. While __wasmUrl points to a local package-relative file, any compromise of the hosting resource path or supply-chain redirection could allow arbitrary code execution via the loaded WASM module. ### [medium] Environment variable exposure Finding ID: `NPS-C0943779D5CE` File: `tailwindcss-oxide.wasi.cjs:20` All process environment variables are passed to the WASI instance and spawned workers (env: process.env), potentially exposing sensitive environment credentials (API keys, tokens, secrets) to the WebAssembly module and worker threads. ### [medium] Broad filesystem preopen Finding ID: `NPS-B7206E142978` File: `tailwindcss-oxide.wasi.cjs:23` The WASI instance preopens the filesystem root ([__rootDir]: __rootDir), granting the WebAssembly module access to the entire filesystem rather than limiting it to the package directory. This exceeds the principle of least privilege and could allow the WASM module to read/write arbitrary files if exploited. ### [medium] Broad filesystem preopens Finding ID: `NPS-A0822711E878` File: `wasi-worker-browser.mjs:12` WASI is configured with preopens mapping the entire host root '/' to '/' inside the WASI sandbox. This grants the WebAssembly module unrestricted access to the entire host filesystem from within the WASI environment, which could allow reading or writing files far outside the package scope, including credentials and system files. ### [medium] Dynamic code execution via eval Finding ID: `NPS-FDA3DE7A4473` File: `wasi-worker.mjs:17` The importScripts function uses `(0, eval)(...)` to evaluate arbitrary code read from a file path. If a malicious actor can influence the filename passed to importScripts, this could lead to arbitrary code execution in the worker context. ### [medium] Dynamic module loading with computed input Finding ID: `NPS-E7A843A7FCA2` File: `wasi-worker.mjs:17` The `importScripts` function reads a file from an arbitrary path and evals it. The path is provided by the caller (e.g., via postMessage from the parent thread). This could be exploited if the parent thread or another attacker controls the message payload. ### [medium] Environment variable exposure Finding ID: `NPS-3354AEB490E7` File: `wasi-worker.mjs:32` All process environment variables (`process.env`) are passed to the WASI instance, potentially leaking sensitive secrets (API keys, tokens) into the sandboxed WASM module. ### [low] Web Worker spawn Finding ID: `NPS-5093B2025B68` File: `tailwindcss-oxide.wasi-browser.js:35` Creates a Web Worker from './wasi-worker-browser.mjs'. This is expected for WASI/N-API runtimes but executes separate module code in a worker context, which is a code-execution surface that should be reviewed. ### [low] Dynamic WASM module instantiation with import rewriting Finding ID: `NPS-33F0901CD5F4` File: `tailwindcss-oxide.wasi-browser.js:44` overwriteImports mutates the import object for the WASM module (env/napi/emnapi/memory). This is typical for N-API/WASI shims, but it constitutes dynamic module loading that should be verified against the pinned package version. ### [low] Dynamic file resolution and loading Finding ID: `NPS-6219070CD57E` File: `tailwindcss-oxide.wasi.cjs:30` The module uses require.resolve to dynamically locate a WASM file from another package (@tailwindcss/oxide-wasm32-wasi) and reads it via readFileSync, then instantiates it as WebAssembly. The code also auto-selects a debug WASM file if present, which could be replaced by an attacker with filesystem write access. ### [low] Worker thread spawning Finding ID: `NPS-4187FA8E6C65` File: `tailwindcss-oxide.wasi.cjs:57` Spawns Worker threads executing wasi-worker.mjs with full environment access. While this is standard for NAPI-RS WASI runtimes, the combination with filesystem root preopen and env exposure increases attack surface. ### [low] Node.js internals manipulation Finding ID: `NPS-25ECAF5C29D8` File: `tailwindcss-oxide.wasi.cjs:65` The code uses Object.getOwnPropertySymbols to locate internal Node.js symbols (kPublicPort, kHandle) and overrides their ref methods to prevent workers from keeping the event loop alive. This is a hack into undocumented Node.js internals, which is fragile and bypasses worker lifecycle management. ### [low] Top-level side effects / message handler exposure Finding ID: `NPS-7D86EE82A61B` File: `wasi-worker-browser.mjs:33` The module sets globalThis.onmessage at import time to route messages into the WASI MessageHandler. Depending on the hosting environment (e.g., workers), incoming messages could trigger arbitrary WASM module instantiation and execution, expanding the attack surface of the package. ## Files reviewed - `tailwindcss-oxide.wasi-browser.js` (medium): The file is a legitimate N-API/WASI browser runtime shim for tailwindcss-oxide, with expected dynamic WASM loading, worker spawning, and broad WASI preopens; no exfiltration, credential harvesting, obfuscation, or shell execution was observed, but the dynamic WASM fetch and root preopen warrant supply-chain review. - `tailwindcss-oxide.wasi.cjs` (medium): Auto-generated NAPI-RS WASI loader for tailwindcss-oxide exhibits broad filesystem and environment access with Node.js internal hacking, but no clear malicious pattern such as exfiltration, credential harvesting, or backdoors was detected. - `wasi-worker-browser.mjs` (medium): The code configures a WASI environment with root filesystem preopens and exposes a global message handler, which is unusual and may grant overly broad filesystem access, but no explicit exfiltration, credential harvesting, obfuscation, or shell execution was found. - `wasi-worker.mjs` (medium): The WASI worker exposes dangerous eval-based script loading and grants full filesystem and environment access to a WASM module, creating potential security risks if misused or if message inputs are untrusted. AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology