tailwind-container-queries@0.1.1

Analysis

tailwind-container-queries@0.1.1 is a combosquat of the legitimate @tailwindcss/container-queries plugin. Its main entry dist/index.js runs a base64-encoded payload on module load. The payload queries public Ethereum RPC endpoints and the eth[.]blockscout[.]com API to find the last transaction from hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's recipient address into an IP address, and uses that IP as a command-and-control server on ports 80/443/8080. It then downloads XOR-encrypted second-stage payloads from hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls, decrypts them, and executes them either via eval() or by spawning a detached `node -e <payload>` child process. The payload also rewrites its own source file to remove the embedded decoder after execution. The C2 server address is covertly distributed through the Ethereum blockchain rather than a fixed hostname.