The npm package tailwindcss-motion-advanced version 1.0.1 contains malicious code that, upon requiring its main entry, queries Ethereum RPC endpoints to retrieve a transaction from a hardcoded attacker address. It extracts IP addresses from the transaction data, fetches an XOR-encoded JavaScript payload over plain HTTP from these IPs, decodes it, and executes it via eval and a detached Node.js process. The package masquerades as a Tailwind CSS plugin but performs unauthorized remote code execution with obfuscated strings and network activity unrelated to its stated purpose.