tailwindcss-3d-styles@1.2.2

Analysis

tailwindcss-3d-styles@1.2.2 ships an obfuscated Ethereum-drainer/C2 implant inside css-utilities/transform.js. The module's eval(atob(...)) decodes a payload that hardcodes attacker address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, queries public Ethereum RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) and the Blockscout API (hxxps://eth[.]blockscout[.]com/api) to locate the attacker's most recent outgoing transaction, then decodes the transaction's destination address into two IPv4 addresses used as C2 endpoints (hxxp://{ip}:80 and :443). The payload spawns detached `node -e` processes that fetch and eval a second-stage payload from the C2, and self-deletes the eval(atob(...)) block from its own source file after running. The implant executes when the package is required (index.js loads ./css-utilities).