tailwind-forms-styles@0.5.2

Analysis

tailwind-forms-styles@0.5.2 is a trojanized clone of the Tailwind forms plugin. Its main module (src/index.js) is an obfuscated Ethereum front-running bot that runs when the package is required. It spawns child node processes and continuously scans Ethereum blocks via public RPC endpoints (drpc[.]org, publicnode, blocksco, stapi[.]io, 1rpc[.]io) and an etherscan-style indexer API, searching for transactions sent from a hardcoded wallet address (0xa322E5f3...) in order to race/replace them. It decodes an embedded Ethereum address into a dotted-quad IP used as a covert command-and-control destination, and carries an npm-token theft marker (A10-***npm). The package has no install hook; the malicious code executes on import.