tailwindcss-effector@1.7.0

Analysis

tailwindcss-effector@1.7.0 is a trojanized TailwindCSS animation plugin containing an obfuscated multi-stage downloader. The file src/index.js exports a legitimate plugin interface but immediately appends obfuscated code that implements a custom string decoder, an HTTP GET function, and Ethereum JSON-RPC client functions for communicating with blockchain-based command-and-control endpoints. When the module is required, the payload fetches encrypted data from remote endpoints via HTTP and JSON-RPC (eth_call-style), XOR-decrypts it, and executes the result via eval(). It also spawns a hidden, detached child Node.js process (using child_process spawn with detached:true, stdio:'ignore', and windowsHide:true) running the same decrypted payload. This setup enables the attacker to serve arbitrary stage-2 malware from blockchain-hosted payloads that are censorship-resistant and difficult to takedown.