tailwindcss-form-utils@0.5.1

Analysis

tailwindcss-form-utils@0.5.1 is a combosquat of the legitimate tailwindcss-forms plugin. Its main module src/index.js is a heavily obfuscated Ethereum drainer that executes when the package is imported. It connects to Ethereum RPC endpoints (drpc[.]org, 1rpc[.]io/eth, publicnode, ethereum-rpc) and to an indexer API at hxxps://etut[.]com/api (Etherscan-style: ?module=account&action=txlist&address=...&startblock=0&endblock=9999999), scans the blockchain for transactions from the attacker-controlled address 0xa322E5f3..., decodes embedded commands/addresses from those transactions, and spawns a child node process to carry them out. Outbound traffic is masked with browser user-agent strings.