Malicious code in tailwindcss-hide-scrollbar (npm)
The npm package tailwindcss-hide-scrollbar contains malicious code that executes on import/require. The package is a typosquat of the legitimate tailwind-scrollbar-hide plugin and includes obfuscated code that attempts to interact with Ethereum blockchain nodes and RPC endpoints.
- Disclosed
- Last updated
- Blast radius
- Any project that installed tailwindcss-hide-scrollbar
- Ecosystems
- Attack vectors
- Affected entities
- tailwindcss-hide-scrollbarMalicious npm package
The npm package tailwindcss-hide-scrollbar contains malicious code embedded in dist/index.js. The package exports a legitimate Tailwind CSS scrollbar-hide plugin but includes a trailing eval(atob(' ')) statement that executes automatically whenever the package is imported or required.
The decoded payload imports Node.js modules for HTTP/HTTPS communication, compression, and process spawning. It contains hardcoded references to Ethereum JSON-RPC methods (eth_getBlockByNumber, eth_blockNumber), Etherscan-style transaction listing paths, and hardcoded RPC/explorer hosts including drpc.org, publicnode.com, blockscout.com, and blast-api.io. The code uses obfuscation techniques including split-string obfuscation and obfuscator.io string-array dispatchers.
The package name inverts the word order of the established tailwind-scrollbar-hide plugin, consistent with a typosquatting attack. A CSS utility plugin has no legitimate need for network I/O, child process spawning, or dynamic code evaluation, indicating malicious intent.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- tailwindcss-hide-scrollbar
Remediation
- Remove tailwindcss-hide-scrollbar from all projects immediately
- Use the legitimate tailwind-scrollbar-hide package instead
- Audit project dependencies for similar typosquatting attacks
- Review any environment variables or secrets that may have been exposed (particularly ETH_RPC_URL)
- Monitor systems for any unauthorized network connections or child processes spawned during package installation
- Check npm audit logs and package-lock.json for installation history of this package
Sources
- GitHub Advisory GHSA-7wrf-vmcc-xhmm · GitHub Advisory Database
Cite this entry
"Malicious code in tailwindcss-hide-scrollbar (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-tailwindcss-hide-scrollbar-npm-t6q0es
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting