The tailwindcss-hide-scrollbar npm package versions 2.5.3 and 2.5.4 include a malicious payload hidden in an obfuscated eval call within dist/index.js. This payload executes on every import and uses Node.js modules such as http, https, zlib, and child_process.spawn to perform network requests and spawn processes. It targets Ethereum JSON-RPC methods and blockchain explorer APIs, reading environment variables like ETH_RPC_URL and connecting to hardcoded RPC and explorer hosts. The package name is a deliberate inversion of the legitimate tailwind-scrollbar-hide plugin, consistent with typosquatting tactics to trick developers into installing malicious code.

Users who install and import this package risk executing malicious code that can perform unauthorized network communications and spawn child processes on their systems. This could lead to data leakage, system compromise, or unauthorized blockchain interactions. The malicious behavior is hidden behind obfuscation and dynamic evaluation, increasing the risk of unnoticed exploitation in development or production environments.

No official patch or remediation is currently documented. Users should immediately avoid installing or using the tailwindcss-hide-scrollbar package, especially versions 2.5.3 and 2.5.4. Verify dependencies carefully to avoid typosquatted packages and prefer the legitimate tailwind-scrollbar-hide plugin. Monitor package sources and use trusted registries. Patch status is not yet confirmed — check the vendor advisory or official npm security advisories for updates.