tailwind-form-kit@0.6.2

Analysis

tailwind-form-kit@0.6.2 is a trojanized clone of the Tailwind CSS forms plugin. Its main module src/index.js is obfuscated and, when imported, scans the Ethereum blockchain via public RPC endpoints for transactions from a hardcoded sender address, decodes the recipient address of that transaction into IP addresses, and fetches second-stage payloads from HTTP URLs built from those IPs. The fetched payloads are XOR-decoded, executed with eval, and also run in detached `node -e` child processes. The module then rewrites its own source file to strip the obfuscated prefix. The C2 endpoints are derived from the recipient address of the hardcoded sender's on-chain transaction.