GCVE-110-OSM-2026-8333

This package masquerades as a legitimate Tailwind CSS line-clamp plugin but appends a multi-layer obfuscated payload to the end of src/index.js via `eval(atob(...))`. Deobfuscation recovered 12 IOCs including URLs querying blockchain node APIs for account data (api.trongrid.io, fullnode.mainnet.aptoslabs.com, bsc-dataseed.binance.org, bsc-rpc.publicnode.com), which is a clear fingerprint of a cryptocurrency wallet-draining or balance-checking attack — the attacker model is crypto asset theft by enumerating wallet balances across TRON, Aptos, and BSC networks. The publisher account 'tailwind1' was created at the same timestamp as the package publication, has published exactly one package, uses a throwaway email at a disposable domain (bittnex.com), and has no repository — all strong indicators of a purpose-built malicious account. The base64 payload uses a custom string-shuffling cipher (RC4-variant with numeric seed 2857687) to further obscure its content before the inner `Function()`-based eval stage executes the recovered blockchain query logic. ENTRY src/index.js (main: src/index.js) DESTINATION - deobfuscated: api.trongrid.io (fetched-payload, deobfuscated) - deobfuscated: fullnode.mainnet.aptoslabs.com (fetched-payload, deobfuscated) - deobfuscated: bsc-dataseed.binance.org (fetched-payload, deobfuscated) - deobfuscated: bsc-rpc.publicnode.com (fetched-payload, deobfuscated) OBFUSCATION - Decoded Base64 Content in src/index.js - IOCs Found in Deobfuscated Code in src/index.js - Dynamic Base64 Decoding in src/index.js: "eval(atob" - Base64 Encoded Payload in src/index.js: ""Z2xvYmFsWychJ109JzEwJzt2YXIgXyRfMWU0Mj0oZnVuY3Rpb24obCxlKXt2YXIgaD1sLmxlbmd0aDt..." - Obfuscation (osm-deobfuscator): unknown in src/index.js - recovered 6 domains, 4 urls, 4 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Base64 Decoded Eval in src/index.js: "eval(atob(" PAYLOAD FILES src/index.js INDICATORS (IOCs) - domains: sh.hR, d.aR - urls: https://api.trongrid.io/v1/accounts/\, https://fullnode.mainnet.aptoslabs.com/v1/accounts/\, https://api.trongrid.io/v1/accounts/, https://fullnode.mainnet.aptoslabs.com/v1/accounts/ - payloadFileHash: dfeed36ce4be37bb492a14716d4b0bb9346f746dbc3974b6df2446bb3a4e5a8f