The npm package tailwind-hide-scrollbar versions 0.0.1, 2.1.5, 2.2.0, and 2.2.1 contains malicious code that executes upon import. This code uses an obfuscated payload to query Ethereum RPC endpoints for commands, which it then executes on the host system, resulting in full Node.js-level remote code execution. The malicious payload uses on-chain command and control, making takedown difficult. Any system with this package installed should be considered fully compromised, and secrets should be rotated immediately.