MAL-2026-13923

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc) The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an `eval(atob(...))` payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's `to` field, fetches an XOR-encrypted command from that IP via an `x-payload-b64` header, and executes the result through `eval` and a detached `spawn('node', ['-e',...])`. This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.