tailwind-animationgroup@2.3.7

Analysis

Combosquat package impersonating tailwindcss-animationgroup (missing "css" in name). Identical payload to tailwind-animationpack@2.3.7. The src/index.js file contains a benign Tailwind plugin facade followed by eval(atob(...)) that decodes a multi-stage crypto drainer. Stage 1 queries Ethereum RPC endpoints (1rpc[.]io, eth[.]drpc[.]org, eth-mainnet[.]public[.]blastapi[.]io, ethereum-rpc[.]publicnode[.]com) to scan blockchain transactions for a hardcoded wallet address. Stage 2 extracts IP addresses from transaction data to derive C2 infrastructure. Stage 3 spawns a detached node child process that beacons to the C2 over HTTP with XOR-encrypted communication. The payload executes on require() via the eval(atob) in the module body.