The fluid-type-ui package at version 2.0.8 includes a concealed code block hidden by a long sequence of tab characters in src/index.js. Upon requiring the module, this code queries specific Ethereum JSON-RPC endpoints for a transaction from a hardcoded Ethereum address. It extracts two IPv4 addresses from the transaction's 'to' field, performs an HTTP GET request to the first address, XOR-decrypts the response with a 16-byte key, and evaluates the decrypted code in a context that exposes require and module objects globally. This mechanism allows the attacker to execute arbitrary code on any system loading the package, with the command-and-control server address dynamically controlled via new blockchain transactions, making takedown difficult. The malicious behavior is unrelated to the package's stated purpose as a Tailwind plugin.

Systems with fluid-type-ui version 2.0.8 installed and loaded are subject to arbitrary remote code execution controlled by an attacker. This results in full system compromise, including potential theft of secrets and keys. The attacker can dynamically update the malicious payload via blockchain transactions, making the infection persistent and resistant to simple removal of the package. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately from a clean environment.

No official patch or fix is currently available for fluid-type-ui version 2.0.8. The package should be immediately removed from all affected systems. Because the malicious code executes arbitrary commands with full control, any system that had this package installed or running should be considered fully compromised. All secrets and keys stored on the system must be rotated from a different, uncompromised machine. Monitor for any signs of persistent malicious activity and consider rebuilding affected systems from known good backups.