tailwind-modernanimation@2.3.8

Analysis

tailwind-modernanimation@2.3.8 ships a hidden C2 loader in its main entry src/index.js. On module load it decodes an embedded base64 payload that queries Ethereum RPC endpoints and the eth[.]blockscout[.]com indexer to locate a transaction from wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, derives two IPv4 C2 addresses from the transaction's recipient bytes, then fetches XOR-encrypted second-stage payloads over HTTP from hxxp://{ip}:80 and hxxp://{ip}:443/0x/cls and /0x/ls. The fetched payloads are decrypted with a charcode XOR loop and executed either via eval or by spawning a detached `node -e` child process (stdio ignored, window hidden, unref'd). The package is otherwise a Tailwind CSS animation plugin, so the loader runs silently when the plugin is required.