MalwarePublished 5 Aug 2026Updated 6 Aug 2026

tailwind-hide-scrollbar (npm) · Malicious Code

Affects tailwind-hide-scrollbarSource GCVE Database

Malicious package : remove tailwind-hide-scrollbar and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:37 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12116

What to do

Remove tailwind-hide-scrollbar from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwind-hide-scrollbar	Affected 0.0.1 – 2.2.1 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tailwind-hide-scrollbar versions 0.0.1, 2.1.5, 2.2.0, and 2.2.1 contains malicious code that executes upon import. This code uses an obfuscated payload to query Ethereum RPC endpoints for commands, which it then executes on the host system, resulting in full Node.js-level remote code execution. The malicious payload uses on-chain command and control, making takedown difficult. Any system with this package installed should be considered fully compromised, and secrets should be rotated immediately.

Impact

Systems that have installed or are running the affected versions of tailwind-hide-scrollbar are fully compromised with remote code execution capabilities granted to attackers. This allows attackers to execute arbitrary code at the Node.js level on the host, potentially leading to complete system takeover, data theft, and persistent backdoors. All secrets and keys stored on compromised systems are at risk and should be considered exposed.

Defensive guidance

Remove the affected versions of the tailwind-hide-scrollbar package immediately. Rotate all secrets and keys from a secure, uncompromised environment. Because the package grants full control to attackers, assume the system is compromised and perform a full incident response and forensic analysis.

Summary

The tailwind-hide-scrollbar npm package in specified versions includes a malicious payload appended to its main export. The payload is obfuscated using base64 and unicode escapes and executes an eval(atob('...')) call that queries multiple Ethereum RPC endpoints for the latest transaction from a hardcoded Ethereum address. It interprets parts of the transaction data as IP addresses and makes HTTP GET requests to those IPs to retrieve further encrypted payloads. These payloads are XOR-decrypted and executed, spawning detached Node.js processes to run second-stage code. This chain grants full remote code execution on any host importing the package. The use of Ethereum blockchain for command and control (EtherHiding) allows dynamic attacker control and resistance to takedown efforts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:37 UTC

Technical details

References

Community reviews