Malicious code in tailwindcss-3d-animate (npm)

The tailwindcss-3d-animate npm package re-exports the legitimate tailwindcss-3d plugin but appends an obfuscated payload that runs on module load. This payload uses eval on a base64-decoded, control-flow-flattened bundle that imports Node.js modules (http/https/zlib/child_process) to fetch and execute code from URLs derived from Ethereum blockchain transaction data. The package name is a typosquat of the legitimate package and copies its source code to avoid suspicion. The malicious code uses an Ethereum address as a dead-drop staging channel, querying public RPC and explorer hosts to retrieve the next stage payload, which is decompressed and executed via eval and child_process spawn, resulting in full system compromise.

Any system with this package installed or running is considered fully compromised. The attacker can execute arbitrary code fetched from the network, potentially gaining full control over the affected computer. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the tailwindcss-3d-animate package is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, uncompromised device. Due to the high likelihood of full system compromise, a complete system reinstallation or forensic investigation is advised to ensure no persistent malware remains. There is no official patch or fix as this is a malicious package rather than a vulnerability in legitimate software.