MAL-2026-12224

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9) dist/index.js appends `eval(atob('...'))` after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated payload on the installer's machine. Identifiers in the payload (`http`, `https`, `child_process`, `spawn`, hostnames, RPC method names) are hidden with `\u00XX` escapes. The decoded payload queries Ethereum public RPCs (1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) and eth.blockscout.com for the latest transaction from the attacker-controlled address 0xa322E5f3D311D3080e6f01210763e9aDC2490Ef1a, treats the first 8 bytes of that transaction's `to` field as two IPv4 addresses, fetches second-stage bytes from `http://<ip>:443/0x/cls` and `http://<ip>:443/0x/ls`, XOR-decodes them, and runs them via `eval` and a detached `spawn('node', ['-e',...], {detached: true, stdio: 'ignore', windowsHide: true}).unref()`. The advertised purpose is a zero-dependency pure-CSS Tailwind plugin; the presence of network, child_process, blockchain lookup, obfuscation, and dynamic code execution in that context has no legitimate purpose. The on-chain dead-drop lookup lets the operator rotate the C2 endpoint at will by broadcasting new transactions from the watched address.