The tailwind-hide-scrollbar npm package in specified versions includes a malicious payload appended to its main export. The payload is obfuscated using base64 and unicode escapes and executes an eval(atob('...')) call that queries multiple Ethereum RPC endpoints for the latest transaction from a hardcoded Ethereum address. It interprets parts of the transaction data as IP addresses and makes HTTP GET requests to those IPs to retrieve further encrypted payloads. These payloads are XOR-decrypted and executed, spawning detached Node.js processes to run second-stage code. This chain grants full remote code execution on any host importing the package. The use of Ethereum blockchain for command and control (EtherHiding) allows dynamic attacker control and resistance to takedown efforts.

Systems that have installed or are running the affected versions of tailwind-hide-scrollbar are fully compromised with remote code execution capabilities granted to attackers. This allows attackers to execute arbitrary code at the Node.js level on the host, potentially leading to complete system takeover, data theft, and persistent backdoors. All secrets and keys stored on compromised systems are at risk and should be considered exposed.

Remove the affected versions of the tailwind-hide-scrollbar package immediately. Rotate all secrets and keys from a secure, uncompromised environment. Because the package grants full control to attackers, assume the system is compromised and perform a full incident response and forensic analysis. No official patch or fix is currently available; therefore, do not use this package until a trusted, clean version is released.