The tailwind-animationpack package version 2.3.7 includes an obfuscated eval(atob(...)) loader appended to its legitimate Tailwind plugin export. This loader decodes Ethereum blockchain transactions from a hardcoded address to obtain IP addresses, fetches an XOR-encoded payload from those hosts, and executes it via eval() and a detached Node.js child process. This mechanism allows the attacker controlling the Ethereum address to execute arbitrary code on any machine that installs or requires this package, effectively compromising the system.

Any system that installs or runs tailwind-animationpack version 2.3.7 is at risk of full compromise. The attacker gains arbitrary code execution with a detached process that persists beyond the parent process, enabling persistent control. Secrets and keys stored on the compromised machine may be exposed or stolen. Removing the package does not guarantee removal of all malicious artifacts, as the attacker may have established further persistence.

Immediate removal of the tailwind-animationpack package version 2.3.7 is recommended. All secrets and credentials stored on the affected machine should be rotated from a separate, trusted device. Due to the high likelihood of full system compromise, a full system rebuild or forensic analysis is advised to ensure no persistent backdoors remain. Patch status is not confirmed; check the vendor or npm advisories for updates or fixed versions before reinstalling.