mountly-tailwind@0.1.3

Analysis

mountly-tailwind ships a 4.5MB index.js consisting of a single eval() call wrapping a ROT-cipher-encoded numeric array, with no readable JS outside the decoder, despite the package being a CSS design-tokens library with no JS entry point in its exports map. The eval uses a custom ROT-cipher decoder to reconstruct and execute an obfuscated second-stage payload at module-load time — a worm-injected, compromised publish.