Malicious code in tailwind-contact-forms (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5) The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at tailwindlabs/tailwindcss-forms, while the actual main entry src/index.js is a heavily obfuscated Node loader (obfuscator.io-style rotated string array _0x18ab with 303 entries, decoder _0x35ba, control-flow-object dispatch). On require(), the loader constructs an Etherscan-style indexer URL and Ethereum JSON-RPC endpoint list (eth.blockscout, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) from decoded string fragments, queries eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount and the txlist API for hardcoded attacker addresses (0xa322E5f3...9aDC2490Ef and 0x...D311D3080e...6f0121063e), and assembles a runtime code payload injected via global['_V...']/global['_t_u']/global['_t_s']/global['_H']/global['_H2']. The loader imports node:child_process.spawn to execute the retrieved payload. This is the EtherHiding pattern: the attacker updates transaction data on-chain to rotate second-stage code without republishing the package, and every consumer that loads tailwind-contact-forms in their tailwind.config.js executes whatever the attacker's on-chain transaction currently points to. A Tailwind plugin has no legitimate need for obfuscation, Ethereum RPC access, block-ex
MAL-2026-15925
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-15925
tailwind-contact-forms
Source reference: /affected/0/package/name
- Affected versions
- 0.5.12
Source reference:
/affected/0/versions0.5.1Source reference:
/affected/0/versions0.5.5Source reference:
/affected/0/versions0.5.9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "tailwind-contact-forms",
"purl": "pkg:npm/tailwind-contact-forms",
"ecosystem": "npm"
},
"versions": [
"0.5.12",
"0.5.1",
"0.5.5",
"0.5.9"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json",
"indicators": {
"evidence_files": [
{
"path": "src/index.js",
"tlsh": "b103c906bac13571234b5f7b760bf4e4e02e2d9d7698048bd129bc94f961329d8e2b39",
"sha256": "901605dc8863d7b3ad4b767d27847881c70a6d9ccb96dc6f3e2a40db779bfb02"
},
{
"path": "package.json",
"tlsh": "dc21cb26cd140e7701e0693696f911837297a463895cfc193396c19c8f8d6bfe0f909f",
"sha256": "5c99aaa1c44832939389b4f27a7b10aec4d559021aab7d02d031fe80ea536e6d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "dfd4597f50aaab8541f224eea73f4adb8be386d4",
"sha512_sri": "sha512-RfKyVBSVuj9Z8lmXNd6W3GDsPWyHRONhWLLxnVN40JwVbsik7EUvftW8FVV938YdtpDWolC3vQqzc9zP2IDDiA=="
},
"filename": "tailwind-contact-forms-0.5.12.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #84302 · Revision 1
- Added to Heist Feed
- Publisher date