Malicious code embedded in a trojanized package. tailwind-scrollbar-hider 5.0.2 is a typosquat of tailwind-scrollbar-hide. Its dist/index.js (the package main) keeps the legitimate one-line scrollbar CSS utility but appends eval(atob(...)) that runs at import time (no install hook required). The decoded payload is obfuscated JavaScript that uses createRequire to load http/https/zlib and child_process, then reads Ethereum on-chain transactions from a hardcoded sender address to decode a command/address and spawns a detached second-stage process (blockchain-based C2 / EtherHiding). Version 5.0.2 only; 5.0.1 and 0.0.1 are clean (trust-building chain). Detected via signature high_risk_sig_mal_478 and EscalatedCombinations.