Malicious code in tailwind-scrollbar-styles (npm)

The malicious code in tailwind-scrollbar-styles version 4.0.3 uses an embedded base64-encoded loader that runs at module load time. This loader queries multiple Ethereum RPC endpoints and Blockscout for the latest transaction from a specific Ethereum address. It extracts four bytes from the transaction's 'to' field, interprets them as an IPv4 address, and sends HTTP GET requests to that address on port 443 to retrieve further payloads. These payloads are XOR-decoded with fixed keys and executed via JavaScript eval and a detached Node.js process. After the first execution, the loader self-modifies the dist/index.js file to remove the malicious eval line, hindering post-incident analysis. The use of Ethereum transactions as a dynamic C2 resolver allows the attacker to change the C2 IP address at will by publishing new transactions from the controlling address.

This malicious package can execute arbitrary code on any system that installs and runs tailwind-scrollbar-styles version 4.0.3. The dynamic retrieval and execution of commands from a remote C2 server controlled via Ethereum transactions enables stealthy and flexible attacker control. The self-erasing nature of the malicious code complicates detection and forensic investigation, increasing the risk of persistent compromise and undetected malicious activity.

No official patch or remediation is currently documented. Users should avoid using tailwind-scrollbar-styles version 4.0.3 and replace it with a clean, verified version or alternative package. Conduct thorough audits of dependencies before installation. Monitor for suspicious network activity related to Ethereum RPC endpoints or unexpected outbound connections to unknown IP addresses. Since the malicious code removes itself after execution, forensic analysis should be performed promptly if this version was installed.