MAL-2026-12220
Malicious code in tailwind-animationpack (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3) src/index.js appends an obfuscated eval(atob(...)) block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and constants behind \uXXXX escapes, queries Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's `to` field into two IPv4 addresses, fetches an XOR-encoded second-stage payload from those hosts, then runs it via eval() and a detached `spawn('node', ['-e', payload], {detached:true, stdio:'ignore', windowsHide:true}).unref()`. The loader executes whenever a consumer require()s the package, giving the operator of the referenced Ethereum address arbitrary code execution on the installer's machine with a detached child process that survives the parent.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-animationpack (npm). Pin to a known-safe version or switch to an alternative.