Malicious code in tailwind-container-queries (npm)

The tailwind-container-queries npm package version 0.1.1 includes an appended eval(atob(...)) block in its dist/index.js file that queries Ethereum RPC endpoints for the last transaction from a hardcoded Ethereum address. It decodes the transaction's recipient field into two IPv4 addresses, which it uses to fetch XOR-encrypted payloads over HTTP. These payloads are decrypted with hardcoded keys; one is executed in-process via eval, and the other is launched as a detached Node.js process to maintain persistence. After execution, the malicious loader rewrites dist/index.js to remove the eval block, hindering analysis. The package mimics the legitimate @tailwindcss/container-queries package by copying its README and repository link. The use of on-chain Ethereum transactions as a command-and-control mechanism allows the attacker to dynamically update the IP addresses serving the payloads, enabling full attacker control over the malicious code delivered to victims.

This malicious package can execute arbitrary code on the host system, establish persistent backdoor processes, and evade detection by removing its payload from disk after execution. The attacker maintains dynamic control over the payloads via Ethereum blockchain transactions, enabling ongoing compromise and potential further malicious activities on affected systems.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove the tailwind-container-queries package version 0.1.1 from their environments and avoid using this package. Verify dependencies and sources before installation, and prefer official packages from trusted maintainers. Monitor for any unauthorized Node.js processes spawned as described and investigate affected systems for compromise. Patch status is not yet confirmed — check vendor advisories or npm security advisories for updates.