GCVE-110-OSM-2026-5998

This package is a typosquat of the legitimate `@tailwindcss/typography` plugin that smuggles a cryptocurrency-targeting payload hidden after 400+ whitespace characters following the legitimate plugin code in `src/index.js`. The malicious section begins with `global['!']='9'` as a canary marker, then bootstraps a heavily obfuscated loader via `_$_1e42` (shuffle-decoded string array), reassigns `global[require]` to escape module sandboxing, and executes a multi-stage eval chain. Deobfuscation reveals four blockchain API endpoints — `api.trongrid.io` (TRON), `fullnode.mainnet.aptoslabs.com` (Aptos), `bsc-dataseed.binance.org`, and `bsc-rpc.publicnode.com` (BSC) — consistent with a clipboard-hijacking wallet drainer that monitors and replaces cryptocurrency addresses across TRON, Aptos, and BNB Chain. The publisher `kikoye6803` is a brand-new single-package account with a disposable-looking email on `nuitx.com`, and there is no source repository, which is consistent with a throwaway attacker infrastructure account. ENTRY src/index.js (main: src/index.js) DESTINATION - deobfuscated: api.trongrid.io (fetched-payload, deobfuscated) - deobfuscated: fullnode.mainnet.aptoslabs.com (fetched-payload, deobfuscated) - deobfuscated: bsc-dataseed.binance.org (fetched-payload, deobfuscated) - deobfuscated: bsc-rpc.publicnode.com (fetched-payload, deobfuscated) OBFUSCATION - IOCs Found in Deobfuscated Code in src/index.js - Whitespace-Padded Hidden Payload in src/index.js: "; global" - Obfuscation: function to array replacements in src/index.js - Suspicious Global Assignment in src/index.js: "global['!']=" - Obfuscation patterns: underscoreDollarVars, splitJoinChain in src/index.js - recovered 4 urls, 4 domains, 4 _domainCandidates from decoded/deobfuscated content PAYLOAD FILES src/index.js INDICATORS (IOCs) - urls: https://tailwindcss.com/docs/typography-plugin, https://play.tailwindcss.com/uj1vGACRJA?layout=preview, https://tailwindcss.com/docs/responsive-design, https://tailwindcss.com/docs/hover-focus-and-other-states, https://tailwindcss.com/discord (+4 more) - domains: tailwindcss.com, play.tailwindcss.com, nicolasgallagher.com, v3.tailwindcss.com - payloadFileHash: 2eafde87ed00532e9de263396629a4612f960ba7788c8fb199d5e88dfac6dc87