MAL-2026-12054

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484) index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's `to` field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via `eval` and a spawned `node -e` child process. Identifiers such as `require`, `http`, `https`, `child_process`, `POST`, `application/json`, `base64`, and the `eth_blockNumber`/`eth_getBlockByNumber` RPC method names are hidden behind `\uXXXX` unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.