The tailwind-animationgroup npm package version 2.3.7 includes obfuscated malicious code appended to its main export. Upon loading, it decodes and executes a loader that queries Ethereum RPC and blockscout endpoints for the latest transaction from a hardcoded Ethereum address. From this transaction, it derives two IPv4 addresses used as C2 endpoints. The loader sends HTTP requests to these endpoints, receiving XOR-encoded payloads in response headers. One payload is evaluated in-process, and the other is executed as a detached Node.js child process. The malicious code uses Unicode escapes and layered base64 encoding to hide strings and endpoint paths. The C2 addresses rotate dynamically based on on-chain data, allowing arbitrary and mutable second-stage payloads. The package's advertised Tailwind animation plugin functionality serves as a decoy to mask the malicious behavior.

Any computer with tailwind-animationgroup version 2.3.7 installed or running is considered fully compromised. The attacker gains arbitrary code execution capabilities, including persistent detached processes. This can lead to full system compromise, unauthorized access to secrets and keys, and potential further malware deployment. Removing the package alone does not guarantee removal of all malicious components due to the arbitrary and mutable nature of the second-stage payloads.

Immediate removal of the tailwind-animationgroup package version 2.3.7 is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted device. Because the system may be fully compromised, a full forensic investigation and system rebuild are advised to ensure complete remediation. No official patch or fix is available for this malicious package; mitigation relies on removal and credential rotation.