tailwind-contact-forms@0.5.9

Analysis

tailwind-contact-forms@0.5.9 is a trojanized clone of the Tailwind CSS forms plugin: src/index.js contains the genuine plugin source with an obfuscated loader prepended to it, so the package works normally while the payload runs on require. The loader is a base64 string array joined and passed to eval(). Decoded, it: 1. Reads the ETH_RPC_URL environment variable and builds a list of public Ethereum JSON-RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io), racing them with Promise.any and keep-alive HTTP agents. 2. Resolves its command-and-control address from the blockchain: it scans recent blocks (eth_blockNumber, eth_getBlockByNumber, eth_getTransactionCount) and the Blockscout API (eth[.]blockscout[.]com/api?module=account&action=txlist&address=0xa322e5f3d311d3080e6f0121063e9adc2490ef1a&startblock=0&endblock=99999999&page=1&offset=20&sort=desc&filterby=from) for the newest transaction sent by hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, then decodes the transaction recipient into two IPv4 addresses. This makes the C2 host updatable on-chain and independent of any domain takedown. 3. Requests the second stage from hxxp://<ip1>:443/0x/cls and hxxp://<ip1>:443/0x/ls with a Chrome User-Agent and an X-V header carrying a per-host counter. The response body is XOR-decoded with the key "q4FZixX{!h,Sr3=@"; if the body is empty the payload is taken from the x-payload-b64 response header and base64-decoded. 4. Executes the decoded stage: on the first call via eval(env + code), on the second by spawning a detached, stdio-ignored, window-hidden `node -e <env + code>` child process and unref-ing it. The injected prelude re-exports require/module as globals so the remote code can load further modules. The package declares no lifecycle hook; the payload executes when the module is required, and the install/require path reaches the Ethereum RPC endpoints and the on-chain-derived C2 over port 443.