MAL-2026-12222 Malicious code in tailwind-opentype (npm)

dist/index.js re-exports a benign Tailwind plugin and appends an eval(atob(…)) payload that runs when the module is required (e.g. from a project's tailwind.config). The decoded payload uses \u-escaped module names to require('http'), require('https'), and require('child_process'), then queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com) for transactions from a hardcoded attacker address (0xa322E5f3D311D3080e6f01210633e9aDC2490Ef1). The transaction's to field is decoded into a pair of C2 IPs, from which an XOR-encoded stage-2 payload is fetched over HTTP at /0x/cls and /0x/ls with an x-payload-b64 header, and executed both via eval() and via a detached spawn('node', ['-e',…]).unref(). Every network destination, module name, and identifier is stored as \u-escaped sequences and the outer payload is base64-wrapped in eval(atob()) to defeat static review. Loading the module yields full remote code execution on the build host with attacker-controlled, on-chain-resolved payloads.