OSV ID
MAL-2026-12054
Ecosystem
npm
Summary
index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's to field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via eval and a spawned node -e child process. Identifiers such as require , http , https , child_process , POST , application/json , base64 , and the eth_blockNumber / eth_getBlockByNumber RPC method names are hidden behind \uXXXX unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.
Source: amazon-inspector (2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.