MAL-2026-12219

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66) src/index.js appends an eval(atob(...)) blob after the tailwind plugin export. On any require()/import of the package, the decoded loader queries Ethereum RPC and blockscout endpoints for the latest transaction from a hardcoded address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), derives two IPv4 C2 endpoints from bytes of that transaction, and issues HTTP requests to http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The responses carry an XOR-encoded payload in an x-payload-b64 header; one payload is eval'd in-process and the other is executed via child_process.spawn('node', ['-e', <code>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(). Strings such as 'child_process', 'http', 'https', 'GET', 'HEAD', 'spawn', and the endpoint paths are hidden with \uXXXX unicode escapes and layered base64 wrapping. The Tailwind animation plugin surface is a decoy; the C2 address rotates via on-chain lookups, so the delivered second-stage is arbitrary and mutable.