tailwindcss-scrollbar-hide @2.3.0

Summary

dist/index.js appends eval(atob('...')) after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated payload on the installer's machine. Identifiers in the payload ( http , https , child_process , spawn , hostnames, RPC method names) are hidden with \u00XX escapes. The decoded payload queries Ethereum public RPCs (1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) and eth.blockscout.com for the latest transaction from the attacker-controlled address 0xa322E5f3D311D3080e6f01210763e9aDC2490Ef1a, treats the first 8 bytes of that transaction's to field as two IPv4 addresses, fetches second-stage bytes from http://<ip>:443/0x/cls and http://<ip>:443/0x/ls , XOR-decodes them, and runs them via eval and a detached spawn('node', ['-e',...], {detached: true, stdio: 'ignore', windowsHide: true}).unref() . The advertised purpose is a zero-dependency pure-CSS Tailwind plugin; the presence of network, child_process, blockchain lookup, obfuscation, and dynamic code execution in that context has no legitimate purpose. The on-chain dead-drop lookup lets the operator rotate the C2 endpoint at will by broadcasting new transactions from the watched address.

Source: amazon-inspector (1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9)