tailwind-scrollbar-styles@4.0.3

Analysis

tailwind-scrollbar-styles@4.0.3 is a tailwindcss plugin whose dist/index.js contains an eval(atob(...)) payload that runs when the module is imported. The decoded payload queries Ethereum RPC endpoints (eth[.]blockscout[.]com, 1rpc[.]io, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) for transactions sent from wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the recipient address of the latest transaction to derive a C2 IP address, then fetches XOR-encoded second-stage payloads from hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls and executes them by spawning detached `node -e` processes (windowsHide, stdio ignored). The payload also rewrites its own source file to remove the eval(atob) block after execution, evading inspection. The package is a trojanized clone of the legitimate tailwind-scrollbar-styles plugin with the implant injected into the main entry point.