registry / tailwindcss-hide-scrollbar / 2.5.3

tailwindcss-hide-scrollbar@2.5.3

tailwindcss plugin for hiding scrollbar

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Importing the package executes an obfuscated blockchain-resolved staged payload. It retrieves and executes remote code outside the package's stated Tailwind CSS purpose.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import of dist/index.js, including Tailwind configuration loading.

Impact

Arbitrary code execution in the importing user's environment; attacker-controlled second stage can perform further actions.

Mechanism

Obfuscated import-time remote payload loader with eval and detached child process execution.

Attack narrative

The advertised scrollbar plugin is followed by an obfuscated base64 payload evaluated at import time. The decoded code queries several Ethereum RPC/explorer services, derives a host from a selected on-chain transaction, downloads an XOR/base64-wrapped payload from that host, and executes it with eval or a detached hidden node process. This creates attacker-controlled remote code execution whenever the module is loaded.

Rationale

The hidden import-time loader, blockchain-based C2 discovery, and remote second-stage execution are concrete malicious behavior unrelated to the package function. No lifecycle hook is required because importing the Tailwind plugin triggers it.

Evidence

package.jsondist/index.jssrc/styles.cssREADME.md

Network endpoints4

1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.com/api

dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing eval(atob('<~32KB obfuscator.io payload>')) that executes on every require()/import of the package. The decoded payload pulls in http, https, zlib and child_process.spawn (with require('child_proc'+'ess') split-string obfuscation and an obfuscator.io string-array dispatcher) and contains hardcoded Ethereum JSON-RPC method names (eth_getBlockByNumber, eth_blockNumber), etherscan-style transaction listing paths (?module=account&action=...&startblock=0&endblock=99999999), a process.env.ETH_RPC_URL read, and hardcoded RPC/explorer hosts under drpc.org, publicnode.com, blockscout.com and blast-api.io. A CSS utility plugin has no legitimate need for network I/O, spawned child processes, or dynamic evaluation of an obfuscated blob. The package name inverts the word order of the established tailwind-scrollbar-hide plugin, consistent with a typosquat carrier for the loader. ## Source: ghsa-malware (db8f8e9574e99a7ff90f6934b87642ac2408d46e35bd267f6281d3e8061071db) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

tailwindcss-hide-scrollbar@2.5.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code