chore(deps): bump @tailwindcss/vite from 4.3.0 to 4.3.3 in /paaster - #1218

Notes: High security risk. This module contains explicit arbitrary JavaScript execution via eval(i.value) in napi_run_script, and also supports dynamic function creation via new Function. If attacker-controlled or untrusted data can reach the script string or function/metadata inputs (e.g., through compromised WASM, tampered handles, or unsafe host hooks), it enables host-context code execution, making this a significant supply-chain and runtime integrity concern.

Confidence: 0.62

Severity: 0.90

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide-wasm32-wasi@4.3.3

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: The provided module fragment is a high-capability WebAssembly runtime/bridge that includes explicit arbitrary code execution primitives (eval in napi_run_script and new Function-based wrapper generation). While much of the remaining code is typical for wasm/N-API glue (memory/handle management, worker coordination), the eval/new Function sinks create a severe risk: if an attacker can influence the script/function strings via wasm handles or worker messaging, this yields arbitrary JavaScript execution in the host environment. No clear evidence of direct exfiltration or credential theft appears in the fragment, but the code-execution capability alone warrants a strong security review and strict trust assumptions.

Confidence: 0.74

Severity: 0.85

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide-wasm32-wasi@4.3.3

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: The module implements a WebAssembly↔Node/browser bridge with thread support, and it contains explicit dynamic code execution sinks: napi_run_script calls g.eval(...) (eval-like) and emnapiCreateFunction uses new Function(...) to generate named functions. Additionally, worker message payloads drive initialization that results in indirect execution via wasm tables. While this could be legitimate for a compatibility/runtime layer, these behaviors are high-risk for supply-chain compromise or attacker-controlled WASM/message inputs. No direct evidence of data exfiltration or backdoor networking is shown in the provided fragment.

Confidence: 0.68

Severity: 0.72

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide-wasm32-wasi@4.3.3

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: This code is a WASM/worker interop runtime shim with significant execution capability. The primary security concern is that it can execute arbitrary JavaScript via g.eval (napi_run_script) and can dynamically generate wrapper functions via new Function (emnapiCreateFunction). Additionally, worker message payloads can drive indirect calls into wasm function tables. The fragment shows no direct exfiltration or persistence mechanisms, so malicious intent is not established, but the attack surface is elevated due to powerful dynamic-execution sinks and trust in WASM/message-controlled inputs.

Confidence: 0.66

Severity: 0.67

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide-wasm32-wasi@4.3.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: The file package/dist/emnapi-core.min.js implements a wasm/N-API interop runtime that includes dynamic code execution surfaces via eval and new Function. If attacker-controlled input can reach these dynamic paths (through napi_run_script or dynamic wrapper code), it can enable arbitrary JavaScript execution (RCE) in the Node process and potentially in spawned workers.

Confidence: 0.63

Severity: 0.74

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide-wasm32-wasi@4.3.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism.

Confidence: 0.90

Severity: 0.60

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide-wasm32-wasi@4.3.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide-wasm32-wasi@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: No explicit data theft, networking, or obvious backdoor logic is present in this JavaScript fragment. The dominant security concern is the high-impact dynamic require() of a value taken directly from NAPI_RS_NATIVE_LIBRARY_PATH, which—if an attacker can influence that environment variable—could enable arbitrary native/module loading (runtime code execution). Other behaviors (musl detection via reading /usr/bin/ldd and running 'ldd --version', plus WASI fallback) look consistent with legitimate environment detection.

Confidence: 0.60

Severity: 0.55

From: paaster/package-lock.json → npm/@tailwindcss/vite@4.3.3 → npm/@tailwindcss/oxide@4.3.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tailwindcss/oxide@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.