tailwind-hide-scrollbar@2.1.5

Analysis

tailwind-hide-scrollbar@2.1.5 ships a legitimate tailwind plugin in dist/index.js but appends an obfuscated eval(atob(...)) payload that installs a covert command-and-control implant. On import, the payload reads the Ethereum blockchain (via public RPC endpoints 1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io, or the ETH_RPC_URL env var, and the typosquatted API eth-blockscout[.]com/api) to fetch the latest transaction from attacker wallet 0xa322E5f3D31D3080e6f0121063e9aDC2490Ef1a, extracting the transaction's `to` field as a 4-byte IP address that becomes the C2 host. It then connects to hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls, downloads XOR-encrypted second-stage payloads, and executes them either via eval() or by spawning a detached `node -e` child process (child_process.spawn with detached:true, windowsHide:true). All C2 traffic is XOR-encrypted with hardcoded keys. The package's stated purpose (a scrollbar-hiding CSS plugin) is unrelated to this behaviour.