Malicious code in tailwindcss-animate-styles (npm)

The malicious code in [email protected] uses an eval(atob(...)) loader that contacts multiple public Ethereum RPC endpoints to retrieve transactions from a specific wallet address. It decodes destination addresses from these transactions into two IPv4 C2 servers, from which it downloads XOR-encoded stage-2 payloads. These payloads are executed via eval and a detached Node.js process with full system capabilities (fs, net, child_process, env). The loader then modifies the package source code to remove itself after initial execution, complicating detection and analysis.

This malicious package enables remote code execution on any system that installs and requires tailwindcss-animate-styles version 1.0.9. The attacker gains full Node.js runtime access, including filesystem and network operations, potentially leading to system compromise, data theft, or further malware deployment. The self-erasing behavior hinders detection and forensic analysis.

No official patch or remediation is currently documented. Users should avoid installing or using tailwindcss-animate-styles version 1.0.9. If already installed, remove the package and audit systems for signs of compromise. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance. Due to the lack of vendor advisory, patch status is not yet confirmed — check the vendor advisory or npm security channels for current remediation guidance.