🛡️ MAL-2026-12220 — tailwind-animationpack

Malicious code in tailwind-animationpack (npm)

Source: amazon-inspector

src/index.js appends an obfuscated eval(atob(...)) block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and constants behind \uXXXX escapes, queries Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's to field into two IPv4 addresses, fetches an XOR-encoded second-stage payload from those hosts, then runs it via eval() and a detached spawn('node', ['-e', payload], {detached:true, stdio:'ignore', windowsHide:true}).unref(). The loader executes whenever a consumer require()s the package, giving the operator of the referenced Ethereum address arbitrary code execution on the installer's machine with a detached child process that survives the parent.