The tailwindcss-effector package (version 1.7.0) includes a heavily obfuscated asynchronous immediately-invoked function expression (IIFE) appended to a legitimate TailwindCSS plugin. Upon import, this IIFE sends HTTPS requests to remote JSON-RPC endpoints mimicking blockchain queries (TRON and Ethereum styles), retrieves encrypted payloads, XOR-decrypts them, and executes the decoded JavaScript via eval. Additionally, it spawns a detached child process whose output is also eval'd, enabling persistent remote code execution. Sensitive strings and URLs are hidden behind a custom string-shuffle decoder. This behavior aligns with a typosquatting attack delivering a malicious payload under the guise of a known plugin. The compromise allows an attacker full control over the infected machine, with command-and-control communication concealed within legitimate blockchain RPC traffic.

Installation and import of tailwindcss-effector version 1.7.0 results in full remote code execution on the host system. The attacker gains persistent control via a detached child process and can execute arbitrary code. This compromises all secrets and keys stored on the machine. The system should be considered fully compromised once this package is present.

No official patch or fix is currently documented. Immediate removal of the tailwindcss-effector package version 1.7.0 is strongly recommended. Because the attacker gains full control, all secrets and credentials stored on the affected machine must be rotated from a different, trusted system. Monitor for any child processes spawned by this package and consider rebuilding the affected environment to ensure complete eradication of the malicious code.