GCVE-110-OSM-2026-12069

src/index.js appends a hidden payload after ~9KB of whitespace padding that decodes and runs via eval(atob(...)) whenever the package is required (the README instructs users to require('tailwind-minanimated') from tailwind.config.js). The payload queries the Ethereum Blockscout API (https://eth.blockscout.com/api) for the latest transaction from hardcoded sender address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the destination address into two IPv4 addresses, fetches second-stage JavaScript from those hosts at paths /0x/cls and /0x/ls, XOR-decrypts the response with hardcoded keys, and executes the result via eval and a detached spawn('node', ['-e', code], {detached:true, stdio:'ignore'}).unref(). The blockchain-based C2 resolution allows the attacker to rotate infrastructure without republishing the package. The tailwind plugin functionality is a cover for the loader. Judge assessment: This is a loader masquerading as a Tailwind plugin: `src/index.js` is the entrypoint for `require('tailwind-minanimated')`, but it appends a hidden payload after massive whitespace and immediately executes `eval(atob(...))`. The deobfuscated payload shows an attacker model consistent with DPRK/Lazarus-style campaign infrastructure: it queries `https://eth.blockscout.com/api` using the hardcoded sender `0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`, resolves second-stage hosts, fetches `/0x/cls` and `/0x/ls`, then runs the result via `eval` and detached `spawn('node', ['-e', code])`. The campaign markers `nullreceiver` and `PolinRider`, plus recovered IOCs like `match.tx.to` and the Ethereum address, corroborate that this is not a false positive but an intentionally obfuscated malware loader. Metadata also supports malice: a brand-new package from a one-package publisher with no repository and a very new npm account. ENTRY src/index.js (main: src/index.js) DESTINATION - 1 exfil (ethereumAddresses) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - Decoded Base64 Content in src/index.js - IOCs Found in Deobfuscated Code in src/index.js - Whitespace-Padded Hidden Payload in src/index.js: "; eval" - Dynamic Base64 Decoding in src/index.js: "eval(atob" - Base64 Encoded Payload in src/index.js: "'Z2xvYmFsLmk9IkE4LSpQIixnbG9iYWwucj1yZXF1aXJlLCJvYmplY3QiPT10eXBlb2YgbW9kdWxlJiY..." - Obfuscation (osm-deobfuscator): unknown in src/index.js - recovered 8 urls, 1 ips, 6 domains, 1 ipv4, 1 ethereumAddresses, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Base64 Decoded Eval in src/index.js: "eval(atob(" - Campaign marker: nullreceiver in [deobfuscated] src/index.js: "q4FZkxX{!h,Sr3=@" - Campaign marker: PolinRider in [deobfuscated] src/index.js: "global['_V']" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES src/index.js