tailwind-animator-scrollnpm

The package's main entry src/index.js appends, after a large whitespace gap following the legitimate-looking Tailwind plugin code, an eval(atob('Z2xvYmFsWychJ109JzExJzt2YXIgXyRfMWU0Mj0...')) call. The decoded first stage re-exposes Node's require and module as global aliases (global['c']=require, etc. — typo-style obfuscation) and then invokes a second-stage IIFE that uses a custom shuffle decoder plus the Function() constructor to assemble and execute a further opaque payload. Because this lives in the main entry, simply adding the plugin to tailwind.config.js executes attacker-controlled code inside the developer's build environment, where CI tokens, environment variables, source code, and credentials are all reachable. The package additionally impersonates the legitimate tailwindcss-animationfound plugin: the README copies its CSS class names and API surface verbatim, the install snippet uses yet another misspelling (tailwind-animatior-scroll), and a shields.io badge links to the real tailwindcss-animationfound package — a typosquat lure designed to catch developers who mistype or fuzzy-search for the legitimate plugin.