tailwind-scrollbar-hider @5.0.2

Summary

dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes eval(atob('<~39KB base64>')) at module top level, so the payload runs on any require()/import of the package. The decoded body is packed with an obfuscator.io-style string-array dispatcher ( _0x355e / _0x12f0 with shuffling) that hides all string literals, and it dynamically resolves node:http , node:https , node:zlib , and child_process.spawn via createRequire(import.meta.url) . At runtime it assembles an Ethereum RPC endpoint list from process.env.ETH_RPC_URL plus hardcoded providers including *.publicnode.com and h.drpc.org , together with an indexer URL and a hardcoded SENDER Ethereum address, and issues eth_blockNumber and block-range requests — the shape of an on-chain wallet-monitoring / drainer relay embedded in a CSS-only utility. A Tailwind scrollbar-hiding plugin has no legitimate need to eval a base64 blob, spawn child processes, open network sockets, or scan Ethereum blocks on import.

Source: amazon-inspector (aaa2dba899c9723740dfcc2fe8588bcf695f021442bbe8de1156239029bf7987)