tailwindcss-3d-animate @1.2.2

Summary

index.js re-exports the legitimate tailwindcss-3d plugin and then appends eval(atob("...")) at module top level, so the payload runs on any require('tailwindcss-3d-animate') . The decoded blob is an obfuscator.io string-array/control-flow-flattened bundle ( _0x240a rotation, global['r']=require , global['m']=module ) that pulls in http/https/zlib/child_process and executes network-fetched code. Decoded strings reveal an Ethereum-address-as-dead-drop staging channel: Etherscan-style ?module=account&action=txlist&address=0xa322E5f3...D311D3080e...9aDC2490Ef queries against public RPC/explorer hosts (drpc.org, eth-mainnet.publicnode, *.blockscout.com) are used to read attacker-controlled on-chain data as the next-stage URL, which is then zlib-inflated and executed via Function/eval and child_process spawn. The package name typosquats the legitimate tailwindcss-3d (same sambauers/tailwindcss-3d repo URL) and reproduces its source verbatim as cover.

Source: amazon-inspector (bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c)