tailwindcss-animate-builder@2.1.0

Analysis

The package index.js fetches a second-stage payload from hxxps://bet[.]slotgambit[.]com/icons/104 over HTTPS and executes the response's 'credits' property via new Function() with full Node.js runtime access (require, process, Buffer, module), enabling arbitrary remote code execution on the installer's machine. The package is disguised as a Tailwind CSS forms builder but ships an unrelated dependency set including hardware fingerprinting (node-machine-id), local database access (better-sqlite3, sqlite3), Windows credential API access (@primno/dpapi), WebSocket support (socket[.]io-client), and an HTTP server (express) — providing a complete implant toolkit for the C2-delivered second stage.