MAL-2026-15635 Malicious code in tailwind-modernanimation (npm)

The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an eval(atob('...')) call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's to field, fetches JavaScript over plain HTTP from http://<ip>:443/0x/cls and http://<ip>:443/0x/ls, and executes it via spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref(). The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.