registry / tailwind-modernanimation / 2.3.8

tailwind-modernanimation@2.3.8

Excellent animation utilities of TailwindCSS

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the package runs an obfuscated remote payload loader. It obtains command data through Ethereum RPC services and executes downloaded code.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer imports or loads the package entrypoint.

Impact

An attacker can run arbitrary code in the consuming user's Node environment.

Mechanism

Obfuscated network-backed remote code execution

Attack narrative

The package entrypoint appends an immediate eval of a Base64-encoded loader. The decoded loader searches Ethereum transaction data for command infrastructure, retrieves a payload over HTTP, then evaluates it directly or starts a detached Node process containing it. This behavior is unrelated to Tailwind animation utilities and gives a remote operator code execution when the package is loaded.

Rationale

The package deliberately conceals a remote code loader in its runtime entrypoint. Its network-selected payload execution is concrete malicious behavior.

Evidence

src/index.jspackage.json

Network endpoints5

eth.blockscout.com/api1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io

tailwind-modernanimation@2.3.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code