MAL-2026-12217 Malicious code in tailwind-animate-plugin (npm)

index.js appends a large base64-encoded, unicode-escaped payload after ~11 KB of whitespace padding, executed via eval(atob('…')) whenever the package is required (main = index.js). The decoded payload queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for transactions from 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from a tx.to field, then HTTP-GETs http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, XOR-decrypts the response, and executes the resulting code via spawn('node', ['-e', payload], {detached: true, stdio: 'ignore', windowsHide: true}).unref(). Sensitive identifiers ('http', 'child_process', 'spawn', 'POST', 'HEAD', 'x-payload-b64', RPC URLs, target address) are stored as \uXXXX escapes to defeat casual scanning. The package presents itself as a Tailwind CSS animation plugin; the dropper is hidden behind the benign plugin body. Any consumer of this package receives arbitrary attacker-controlled code execution on the host at require time, with the C2 host resolvable on-chain and thus resistant to takedown.