tailwind-opentype@1.2.3

Analysis

tailwind-opentype@1.2.3 is a trojanized clone of a legitimate Tailwind CSS OpenType plugin. The dist/index.js file re-exports the real plugin code to appear legitimate, but on require() executes an eval(atob(...)) payload that deploys an Ethereum blockchain scanner and wallet drainer. The payload connects to Ethereum RPC endpoints (eth-mainnet[.]public[.]blastapi[.]io and others) to scan for transactions, extracts IP addresses from transaction data, and establishes XOR-encrypted C2 communication over HTTP to hxxp://{extracted-ip}:443/0x/cls and hxxp://{extracted-ip}:443/0x/ls. It spawns detached node child_processes to execute further stages. The package has no repository URL and no license.