🛡️ MAL-2026-12219 — tailwind-animationgroup

Malicious code in tailwind-animationgroup (npm)

Source: amazon-inspector

src/index.js appends an eval(atob(...)) blob after the tailwind plugin export. On any require()/import of the package, the decoded loader queries Ethereum RPC and blockscout endpoints for the latest transaction from a hardcoded address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), derives two IPv4 C2 endpoints from bytes of that transaction, and issues HTTP requests to http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The responses carry an XOR-encoded payload in an x-payload-b64 header; one payload is eval'd in-process and the other is executed via child_process.spawn('node', ['-e', <code>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(). Strings such as 'child_process', 'http', 'https', 'GET', 'HEAD', 'spawn', and the endpoint paths are hidden with \uXXXX unicode escapes and layered base64 wrapping. The Tailwind animation plugin surface is a decoy; the C2 address rotates via on-chain lookups, so the delivered second-stage is arbitrary and mutable.