Malicious code in tailwind-custom-templates (npm)

The npm package tailwind-custom-templates was published with malicious code embedded in its main entry point (src/index.js). While the package advertises itself as a Tailwind CSS form-styling plugin and includes a copy of the legitimate tailwindcss-forms library, it appends obfuscated code generated by obfuscator.io that executes immediately upon import.

The malicious payload decodes to code that performs Ethereum-related network activity, including hardcoded references to an Ethereum RPC provider (drpc.org), Etherscan-style API endpoints, and a hardcoded Ethereum address (0xa322E5f3...). The code assembles HTTP requests with standard headers and User-Agent strings, consistent with wallet-address-swap/clipper malware or on-chain command-and-control functionality.

The package name does not match the bundled source code (tailwindcss-forms) or the referenced Tailwind Labs repository, indicating intentional masquerade. The declared purpose of Tailwind CSS form styling has no legitimate need for Ethereum RPC or blockchain explorer traffic, confirming the malicious intent.

This attack vector represents a supply chain compromise where a malicious package was published to npm with the intent to compromise installer machines at import time.