tailwind-animationpack @2.3.7

Summary

src/index.js appends an obfuscated eval(atob(...)) block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and constants behind \uXXXX escapes, queries Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's to field into two IPv4 addresses, fetches an XOR-encoded second-stage payload from those hosts, then runs it via eval() and a detached spawn('node', ['-e', payload], {detached:true, stdio:'ignore', windowsHide:true}).unref() . The loader executes whenever a consumer require()s the package, giving the operator of the referenced Ethereum address arbitrary code execution on the installer's machine with a detached child process that survives the parent.

Source: amazon-inspector (63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3)