Malicious code in tailwind-scrollbar-styles (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada) dist/index.js exports a small tailwind plugin and then runs eval(atob("Z2x...")) on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints (1rpc.io/eth, drpc.org, publicnode, blastapi.io) and Blockscout for the most recent transaction sent by hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes four bytes of that transaction's `to` field into an IPv4 address, HTTP-GETs http://<decoded-ip>:443/0x/cls and http://<decoded-ip>:443/0x/ls, XOR-decodes the response with literal keys, and executes it via eval() and via a detached `spawn("node", ["-e",...], {detached:true, stdio:"ignore", windowsHide:true}).unref()`. After first execution the loader reads its own file, locates the `eval(atob("Z2x...` region, and rewrites dist/index.js with the region removed, so the malicious line disappears from disk. The Ethereum-transaction-based resolver lets the operator rotate the C2 IP at any time by publishing a new transaction from the controlling address, and the self-erasing stub defeats post-incident inspection of the installed copy.
Malicious code in tailwind-scrollbar-styles (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada) dist/index.js exports a small tailwind plugin and then runs eval(atob("Z2x...")) on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints (1rpc.io/eth, drpc.org, publicnode, blastapi.io) and Blockscout for the most recent transaction sent by hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes four bytes of that transaction's `to` field into an IPv4 address, HTTP-GETs http://<decoded-ip>:443/0x/cls and http://<decoded-ip>:443/0x/ls, XOR-decodes the response with literal keys, and executes it via eval() and via a detached `spawn("node", ["-e",...], {detached:true, stdio:"ignore", windowsHide:true}).unref()`. After first execution the loader reads its own file, locates the `eval(atob("Z2x...` region, and rewrites dist/index.js with the region removed, so the malicious line disappears from disk. The Ethereum-transaction-based resolver lets the operator rotate the C2 IP at any time by publishing a new transaction from the controlling address, and the self-erasing stub defeats post-incident inspection of the installed copy.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-15904
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a9ad4edacd9273b49b6781c
Added to database: 09/04/2026, 14:25:49 UTC
Last updated: 09/04/2026, 14:25:49 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.