If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce)
The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an `eval(atob('...'))` call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's `to` field, fetches JavaScript over plain HTTP from `http://<ip>:443/0x/cls` and `http://<ip>:443/0x/ls`, and executes it via `spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref()`. The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.