The fluid-type-ui npm package version 2.0.8 contains hidden malicious code that executes arbitrary attacker-controlled commands when the package is required. This code fetches data from Ethereum JSON-RPC endpoints, decrypts it, and evaluates it, enabling persistent and dynamic command-and-control. The package masquerades as a Tailwind plugin but includes unrelated malicious functionality. Any system with this package installed should be considered fully compromised.