The tailwindcss-scrollbar-hide npm package versions 0.0.1, 2.2.5, 2.2.6, and 2.3.0 include malicious code in dist/index.js that appends an eval(atob('...')) payload after the legitimate CSS plugin export. This payload is obfuscated using Unicode escapes and, when decoded, performs blockchain queries to Ethereum public RPC endpoints and eth.blockscout.com to retrieve the latest transaction from an attacker-controlled address. It extracts two IPv4 addresses from the transaction data, fetches second-stage payloads from these IPs over HTTP, XOR-decodes them, and executes them via eval and a detached Node.js process. This mechanism allows the attacker to dynamically rotate command and control endpoints via on-chain transactions. The package's advertised function as a pure CSS plugin is a facade for this malicious behavior. The compromise is severe, as the attacker gains full control of the infected system.

Any system that installs or runs the affected versions of tailwindcss-scrollbar-hide is fully compromised. The attacker can execute arbitrary code remotely, potentially leading to theft of secrets, credentials, and keys stored on the machine. The dynamic retrieval and execution of payloads from attacker-controlled infrastructure means the attacker can maintain persistent and evolving control. Removal of the package does not guarantee eradication of all malicious artifacts or backdoors, as the attacker may have established additional footholds.

Remove the affected versions of tailwindcss-scrollbar-hide immediately. Rotate all secrets, keys, and credentials that were stored or used on the compromised system, using a different, trusted machine. Because the attacker gains full control, assume the system is fully compromised and consider rebuilding or isolating it. There is no known patch or fixed version; avoid using this package entirely. Monitor for any suspicious activity related to this package and its dependencies.