tailwind-form-core@0.5.5

Summary

The package's declared main entry src/index.js begins with eval(atob('<~50KB base64 blob>')) that runs on every require/import. Decoding the string-array reveals node:http/https, node:child_process (spawn), '[eval]', stdin.write, and Ethereum RPC calls (eth_blockNumber, eth_getTransactionCount, eth_getBlockByNumber) issued to publicnode.com and drpc.org, plus Blockscout txlist queries ('/api?module=account&action=txlist'). The loader retrieves attacker-controlled payload data from these blockchain/dead-drop endpoints and executes it by piping into a spawned 'node -e' child process, yielding arbitrary code execution on the consumer host whenever the module is loaded. The payload destinations are concealed through obfuscator.io-style string-array + base64 wrapping with runtime index decoders (_0x5c1d/_0xa42d). The legitimate @tailwindcss/forms plugin source (plugin.withOptions(...)) is appended after the eval() so the package appears functional. package.json impersonates Tailwind Labs by falsifying repository to 'tailwindlabs/tailwindcss-forms' and author to '@tailwindcss', while the real package name 'tailwind-form-core' is a lookalike of the official '@tailwindcss/forms'.

Source: amazon-inspector (982a885e35238eeb63f37a2d7e87eac99ff0eaad0514cd7f61778e5511694d01)