tailwindcss-forms-style@0.1.2

Analysis

tailwindcss-forms-style is a trojanized clone of the tailwindcss-forms plugin. Its main module src/index.js bundles the legitimate plugin code but appends an obfuscated payload that executes on require. The payload queries Ethereum RPC endpoints (eth[.]blockscout[.]com, 1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) to locate a sender transaction for contract 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives a C2 host from the transaction's recipient address, then spawns a detached `node -e` process that connects to that C2 over HTTP and XOR-decodes and executes payloads received in the x-payload-b64 response header. It beacons to hxxp://{c2}:443/0x/cls and /0x/ls, and after running it rewrites its own source file to remove the payload. This is a remote-code-execution proxy-botnet implant that runs whenever the package is imported.