OpenSSF/OSV advisory MAL-2026-12054 confirms this npm version as malicious. index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's `to` field, fetches XOR-encrypted payloads over plain HTTP from paths...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in uibabai (npm)
Details
index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's `to` field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via `eval` and a spawned `node -e` child process. Identifiers such as `require`, `http`, `https`, `child_process`, `POST`, `application/json`, `base64`, and the `eth_blockNumber`/`eth_getBlockByNumber` RPC method names are hidden behind `\uXXXX` unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.
Decision reason
OpenSSF Malicious Packages via OSV confirms uibabai@5.7.5 as malicious (MAL-2026-12054): Malicious code in uibabai (npm)