fluid-type-ui @2.0.8

Summary

src/index.js in fluid-type-ui@2.0.8 contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is loaded via require. The block queries Ethereum JSON-RPC endpoints (1rpc.io/eth, eth.drpc.org, eth.blockscout.com) for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, extracts two IPv4 addresses embedded in the transaction's to field, HTTP-GETs /0x/ls from the first, XOR-decrypts the response with a 16-byte key, and passes the decoded bytes to eval with a prelude that binds global.r=require and global.m=module . The result is arbitrary attacker-controlled code execution on every require of the package, with the command-and-control destination mutable via new on-chain transactions, making takedown resistant. The package is presented as a Tailwind plugin; the EtherHiding-style loader has no relationship to that stated purpose.

Source: amazon-inspector (de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216)