tailwindcss-3d-animate@1.2.2

Analysis

tailwindcss-3d-animate is a trojanized clone of the legitimate tailwindcss-3d plugin. Its main entry (index.js) appends a base64-encoded, obfuscated Ethereum wallet-drainer payload to the real plugin code. On load it decodes and executes a client that reads wallet credentials, queries Ethereum RPC endpoints (blockcsco, drpc[.]org, publicnode, 1rpc, stapi[.]io, mainnet, 0x/ls, 0x/cl), and broadcasts signed transactions via eth_sendRawTransaction, draining the victim's wallet. The payload is obfuscated with an encoded string array and custom decoder.