tailwind-custom-templates@0.7.2

Analysis

tailwind-custom-templates@0.7.2 is a trojanized clone of the tailwindcss-forms plugin. The package's main entry src/index.js contains the genuine plugin source followed by an obfuscated payload that executes when the module is loaded. The payload is an Ethereum wallet drainer: it reads the ETH_RPC_URL environment variable, spawns child processes, and queries Ethereum RPC endpoints (h[.]drpc[.]org, publicnode, stapi[.]io, 1rpc, ethereum-rpc, pc[.]io/eth) and Etherscan API paths (?module=ac, on=txlist&, address=, count&acti, ort=desc&f, ilterby=fr, ffset=20&s, k=0&endblo, ck=9999999) using eth_getTransactionByHash, eth_getBlockByNumber and eth_blockNumber. It embeds a hardcoded Ethereum address 0xa322E5f3 as the drainer destination and spoofs a Chrome browser User-Agent on its HTTP requests.