tailwindcss-3d-animate@1.2.2

One or more suspicious static signals were detected.

Any Node.js process that imports or requires tailwindcss-3d-animate.

An attacker can deliver and run arbitrary code in the importing user's environment.

Obfuscated blockchain-backed payload retrieval followed by eval or detached process execution.

The package's declared main entry imports normally as a Tailwind plugin, then immediately decodes and evaluates an appended hidden program. Static decoding shows that program contacts Ethereum RPC endpoints, finds transaction data, transforms it into a second-stage script, and executes that script through eval or a detached child process. This is an import-time remote code execution loader unrelated to the package's stated CSS functionality.

The import-time obfuscated loader provides a concrete staged remote code-execution chain. It is not needed for the advertised Tailwind plugin behavior.