tailwindcss-scrollbar-hide@2.2.6

Analysis

tailwindcss-scrollbar-hide@2.2.6 is a trojanized clone of the legitimate tailwind plugin: the real scrollbar-hide plugin code is present, but dist/index.js appends an eval(atob(...)) payload. The decoded payload is an Ethereum wallet-drainer / C2 implant. It queries Ethereum JSON-RPC endpoints (eth-blockscout[.]com, eth-drpc[.]org, eth[.]llamarpc[.]com, eth-mainnet[.]public[.]blastapi[.]io, 1rpc[.]io/eth) to read blockchain state and locate a target address, derives two C2 IP addresses from the transaction recipient address, and spawns a detached node process (detached, stdio ignored, windowsHide) that beacons to hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls. Traffic is XOR-encrypted with a key derived from the target address. The implant runs on module load with no user interaction.