tailwindcss-hide-scrollbar@2.5.4

Analysis

tailwindcss-hide-scrollbar@2.5.4 is a trojanized clone of the legitimate tailwind scrollbar-hide plugin. The package's main entry dist/index.js appends an obfuscated payload (encoded string array with a custom decoder) to the genuine plugin code. On module load the payload executes an Ethereum RPC client that connects to blockchain endpoints (drpc[.]org, stapi[.]io, blockscout, herum-rpc, h.blockcso, pc[.]io/eth, ut[.]com/api, h-mainnet) and issues eth_getBalance, eth_getTransactionCount, eth_getCode, eth_getStorageAt, eth_blockNumber and eth_getBlockByNumber queries, using an 'x-payload-' HTTP header and ':443/0x/cl' and ':443/0x/ls' request paths. The payload also uses child_process and zlib gunzip/base64 decoding stages, consistent with a wallet-drainer / blockchain-recon implant that reads on-chain wallet state and exfiltrates it over HTTP/HTTPS.