tailwindcss-fluid-styles@2.0.7

Analysis

The tailwindcss-fluid-styles package (a Tailwind plugin) ships a base64-encoded payload in src/index.js that executes on require. The payload queries the Ethereum blockchain (via eth[.]blockscout[.]com and several public RPC endpoints) for the latest transaction sent from wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction recipient address into an IP address, then fetches XOR-encrypted second-stage payloads from that IP over HTTP (paths /0x/cls and /0x/ls) and executes them by spawning a detached `node -e` subprocess. The code also rewrites its own source file to remove the embedded payload after execution.