tailwind-input-kit@0.5.5

Summary

The package impersonates @tailwindcss/forms (name 'tailwind-input-kit', author.name '@tailwindcss', repository pointing to github.com/tailwindlabs/tailwindcss-forms, with README/HTML/CHANGELOG copied from the official plugin) while prepending a malicious loader to src/index.js. The file begins with eval(atob('<~50KB base64 blob>')) that executes before any legitimate plugin code is reached on require(). The decoded blob is a heavily _0x-obfuscated loader that imports node:http, node:https, node:zlib, and node:child_process (spawn), reconstructs destinations from an obfuscated string array (including an api endpoint on an external host, Ethereum JSON-RPC endpoints such as publicnode and drpc.org, and Etherscan-style txlist queries parameterized by hardcoded 0x addresses), issues outbound HTTPS requests carrying a custom 'x-payload-' header, decompresses gzip/brotli/deflate responses, and hands the resulting JavaScript to eval ('[eval]' marker present). The loader additionally spawns a child 'node' process with stdin piping, injects the parent's require and module into globals (global.r, global.m, global._H, global._H2, global._V, _t_s, _t_u), and feeds the fetched second-stage script into that child — giving the remote operator full code execution on the installer's host on every require(), with the ability to deliver new payloads at will. The retained tailwindcss-forms plugin code after the eval() serves as cover for a cursory read.

Source: amazon-inspector (630101a331666e0b23f3bf13fc5b6390d361ccc4be631c55f6ea29d10f3f7711)