Malicious code in fluid-type-ui (npm)
fluid-type-ui@2.0.8 on npm contains hidden malicious code that executes arbitrary attacker-controlled code on module load via an Ethereum-based command-and-control mechanism. The code queries Ethereum JSON-RPC endpoints for instructions embedded in blockchain transactions, making it resistant to traditional takedown.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of fluid-type-ui@2.0.8
- Ecosystems
- Attack vectors
- Affected entities
- fluid-type-ui · 2.0.8
The npm package fluid-type-ui version 2.0.8 was found to contain obfuscated malicious code in src/index.js. The code is hidden using a long run of tab characters to push it off-screen, evading casual inspection.
When the module is loaded via require(), the hidden block executes and queries multiple Ethereum JSON-RPC endpoints (1rpc.io/eth, eth.drpc.org, eth.blockscout.com) for a transaction from a hardcoded Ethereum address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a). The malicious code extracts two IPv4 addresses embedded in the transaction's to field, retrieves encrypted payload from the first address via HTTP GET to /0x/ls, XOR-decrypts the response using a 16-byte key, and executes the decrypted bytes as JavaScript code via eval().
The execution context includes global bindings for require and module, enabling full arbitrary code execution with the privileges of the Node.js process. The use of blockchain-based command-and-control makes the attack infrastructure mutable and resistant to traditional domain/IP-based takedown, as new instructions can be deployed via on-chain transactions.
The package is presented as a Tailwind CSS plugin, but the malicious loader has no functional relationship to that stated purpose, indicating the package was either compromised or created with malicious intent from inception.
Indicators of compromise
- Packages
- fluid-type-ui@2.0.8
- Domains
- 1rpc.io
- eth.drpc.org
- eth.blockscout.com
Remediation
- Immediately remove fluid-type-ui@2.0.8 from all dependencies and lock files
- Audit npm install logs and dependency trees to identify all projects that may have installed this version
- Regenerate all secrets, API keys, and credentials that may have been exposed to processes running this package
- Scan affected systems for indicators of compromise (network connections to the hardcoded Ethereum addresses or the extracted C2 IPs)
- Update to a safe version of fluid-type-ui if one is available, or replace with an alternative Tailwind plugin
- Review npm audit and supply chain security tools for similar obfuscation patterns in other dependencies
Sources
- GitHub Advisory GHSA-44q9-v3f9-xcx6 · GitHub Advisory Database
Cite this entry
"Malicious code in fluid-type-ui (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-fluid-type-ui-npm-1uzfyn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package