MAL-2026-11136

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216) src/index.js in fluid-type-ui@2.0.8 contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is loaded via require. The block queries Ethereum JSON-RPC endpoints (1rpc.io/eth, eth.drpc.org, eth.blockscout.com) for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, extracts two IPv4 addresses embedded in the transaction's `to` field, HTTP-GETs `/0x/ls` from the first, XOR-decrypts the response with a 16-byte key, and passes the decoded bytes to eval with a prelude that binds `global.r=require` and `global.m=module`. The result is arbitrary attacker-controlled code execution on every require of the package, with the command-and-control destination mutable via new on-chain transactions, making takedown resistant. The package is presented as a Tailwind plugin; the EtherHiding-style loader has no relationship to that stated purpose.