scrollbar-hide-plugin@1.0.1

Analysis

scrollbar-hide-plugin@1.0.1 is a trojanized clone of the legitimate tailwind-scrollbar-hide plugin. The dist/index.js exports the real CSS utility function but appends an eval(atob(...)) payload that implements an Ethereum blockchain-based C2 implant. The payload queries blockchain RPC endpoints for transactions from a hardcoded Ethereum address (0xa332e5f3dd3311d330e6f01...), extracts IP addresses from the transaction 'to' fields (hex-decoded), and uses those IPs as C2 servers on ports 80, 443, and 8080. It communicates via XOR-encrypted HTTP, fetches second-stage payloads, and executes them in detached node processes. The package attempted network egress to C2 infrastructure extracted from the blockchain.