fluid-type-ui@2.0.8

Analysis

Combosquat trojanized clone of the legitimate tailwindcss-fluid-type package. The package's src/index.js contains an injected payload that uses a hardcoded Ethereum address to query blockchain RPC endpoints (1rpc[.]io, eth[.]drpc[.]org) for a transaction whose `to` field encodes a C2 server IP address and port. It then connects to that C2 server over HTTP, XOR-decrypts a second-stage payload, and executes it via eval. The package has no repository and no install scripts — the payload runs when the module is required.