tailwindcss-3d-animate@1.2.1

No blocking static signals were detected.

Loading the package through a Tailwind configuration or any require/import of index.js.

Arbitrary code can run in the developer or build environment.

Obfuscated remote payload retrieval followed by eval or detached Node execution.

The declared main file first defines the expected Tailwind plugin, then appends a large Base64-encoded program. Static decoding shows that importing the package immediately queries Ethereum RPC services, uses transaction data to derive an additional remote location, retrieves an encoded response, and executes the result with eval or a detached Node process. This behavior is unrelated to CSS utilities and creates a remote code execution path during normal package use.

The package contains a concealed import-time remote code execution payload unrelated to its advertised Tailwind functionality. No lifecycle hook is needed because normal loading of the main entry activates it.