tailwind-anim @1.2.5

Summary

index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader queries Ethereum JSON-RPC block explorers for transactions from hardcoded address 0xa322e5f3d311d3080e6f01210463e9adc2490ef1a, decodes an IP address from the transaction's to field, fetches an XOR-encrypted JavaScript payload from http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls (payload delivered via an x-payload-b64 header, XOR-decoded with a User-Agent-derived key), and executes the result via eval and a detached, windowHidden spawn('node', ['-e',...], {detached: true, stdio: 'ignore', windowsHide: true}).unref() child process. Sensitive identifiers (http, https, child_process, spawn, URLs) are stored as \uXXXX-escaped strings inside a base64 wrapper. The on-chain lookup lets the operator rotate C2 endpoints by broadcasting new transactions from the attacker-controlled address, giving arbitrary remote code execution on any machine that installs or requires this package.

Source: amazon-inspector (21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0)