registry / tailwindcss-hide-scrollbar / 2.5.4

tailwindcss-hide-scrollbar@2.5.4

tailwindcss plugin for hiding scrollbar

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Importing the package executes a concealed payload unrelated to scrollbar styling. The payload performs network activity and can execute dynamically constructed code in a detached child process.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import of dist/index.js, including Tailwind configuration loading.

Impact

Arbitrary code execution in the importing user's environment.

Mechanism

Obfuscated import-time payload with network-assisted child-process execution.

Attack narrative

The published entrypoint hides a base64-encoded, heavily obfuscated payload after the legitimate plugin export. Importing it immediately decodes and evaluates the payload. Its decoded source reads an Ethereum RPC environment value, performs HTTP(S) requests to multiple Ethereum services, then dynamically evaluates constructed code or spawns a detached hidden Node process using `-e`. This behavior is unrelated to the declared CSS utility and provides an import-time remote-code-execution chain.

Rationale

The concealed payload executes automatically on import and contains both network logic and dynamic detached child-process execution. This is concrete malicious behavior, not a package-aligned primitive.

Evidence

package.jsondist/index.js

Network endpoints5

1rpc.io/etheth.drpc.orgeth.blockscout.com/apieth-mainnet.publicnode.com

dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing eval(atob('<~32KB obfuscator.io payload>')) that executes on every require()/import of the package. The decoded payload pulls in http, https, zlib and child_process.spawn (with require('child_proc'+'ess') split-string obfuscation and an obfuscator.io string-array dispatcher) and contains hardcoded Ethereum JSON-RPC method names (eth_getBlockByNumber, eth_blockNumber), etherscan-style transaction listing paths (?module=account&action=...&startblock=0&endblock=99999999), a process.env.ETH_RPC_URL read, and hardcoded RPC/explorer hosts under drpc.org, publicnode.com, blockscout.com and blast-api.io. A CSS utility plugin has no legitimate need for network I/O, spawned child processes, or dynamic evaluation of an obfuscated blob. The package name inverts the word order of the established tailwind-scrollbar-hide plugin, consistent with a typosquat carrier for the loader. ## Source: ghsa-malware (db8f8e9574e99a7ff90f6934b87642ac2408d46e35bd267f6281d3e8061071db) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

tailwindcss-hide-scrollbar@2.5.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code