MAL-2026-12220
Malicious code in tailwind-animationpack (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3) src/index.js appends an obfuscated eval(atob(...)) block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and constants behind \uXXXX escapes, queries Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's `to` field into two IPv4 addresses, fetches an XOR-encoded second-stage payload from those hosts, then runs it via eval() and a detached `spawn('node', ['-e', payload], {detached:true, stdio:'ignore', windowsHide:true}).unref()`. The loader executes whenever a consumer require()s the package, giving the operator of the referenced Ethereum address arbitrary code execution on the installer's machine with a detached child process that survives the parent.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for tailwind-animationpack (npm). Pin to a known-safe version or switch to an alternative.