tailwind-form-styles@0.5.1

Summary

The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is heavily obfuscated (obfuscator.io-style rotated string array of 303 entries, hex-named identifiers, control-flow flattening) and has no relationship to the legitimate tailwindlabs/tailwindcss-forms project it mimics. On require()/import — which occurs whenever a consumer loads the plugin from tailwind.config — the module imports node:http, node:https, node:zlib and spawn from node:child_process, and installs global['r']=require and global['m']=module to stage further execution. It then issues HTTP requests to endpoints reconstructed from string-array fragments: an Etherscan-style transaction-list indexer and multiple Ethereum RPC hosts (drpc.org, publicnode, blockscout). A hardcoded Ethereum address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a is reassembled from fragments and used as the SENDER filter in eth_blockNumber, eth_getBlockByNumber, eth_getTransactionCount calls and in the txlist URL, and custom X-Payload-* headers gate later stages. The combination of Tailwind-plugin cover, obfuscated destination reconstruction, import-time network I/O to attacker-controlled infrastructure, child_process availability, and Ethereum on-chain command-and-control is the shape of a wallet-drainer / RCE stager, not a CSS plugin.

Source: amazon-inspector (353df78be0134825a2efc6d7e4d4cbf25dfba4d057925e64fc117e78a3f2814a)