If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631)
src/index.js executes an eval(atob(...)) blob at top level on require(). The decoded loader queries Ethereum RPC endpoints for the latest transaction from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes that transaction's `to` field into two IPv4 addresses used as C2 hosts. It fetches XOR-encrypted payloads from paths /0x/cls and /0x/ls on those hosts, eval()s the first, and spawns `node -e <payload>` with `{detached:true, stdio:'ignore', windowsHide:true}` and.unref() to run the second as a persistent hidden background process on the installer's host. Immediately after execution the module reads its own source, locates the eval(atob("Z2x...")) region and rewrites __filename on disk to remove it, leaving a benign-looking tailwind plugin after first import. The package presents itself as a Tailwind CSS fluid-styles plugin; the attacker-controlled code, blockchain-based C2 resolution, self-erasing loader and detached implant have no relationship to that stated purpose.