tailwind-anim@1.2.5

Analysis

tailwind-anim@1.2.5 is a trojanized clone of a Tailwind CSS animation plugin. The package ships a legitimate-looking plugin in index.js with a hidden eval(atob()) payload appended. At runtime, the payload monitors the Ethereum blockchain by making JSON-RPC calls (eth_blockNumber, eth_getBlockByNumber, eth_getTransactionCount) to multiple public RPC endpoints (1rpc[.]io, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io). It searches for transactions from a hardcoded address, extracts the recipient address from matching transactions, and uses the first 4 bytes of that address as a C2 IP (port 80) and the next 4 bytes as a secondary C2 IP (port 80/443). It then establishes XOR-encrypted HTTP communication with the C2, spawns a detached node process for persistence, and attempts to fetch and execute additional payloads from the C2 at paths /0x/cls and /0x/ls.