Malicious code in tailwindcss-form (npm)

{
  "id": "7f27d2264644b48c079462bf81b479c0cd3b93b86c92c5ae002d02a51e7f13d8",
  "url": "https://osv.dev/vulnerability/MAL-2026-16282",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in tailwindcss-form (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f5c6b39e2bde3263d10e2f20e707d06b981e746fda83ef7772233db33ae7a4f2) Package name mimics the legitimate tailwindcss-forms plugin (repo field points at tailwindlabs/tailwindcss-forms) but the main entry src/index.js is an obfuscator.io-packed bundle (303-entry rotated string array, control-flow flattening) whose top-level code has no relation to a Tailwind CSS plugin. On require() it loads node:http, node:https, node:zlib, and node:child_process, then issues requests to a set of hardcoded Ethereum endpoints (eth.blockscout.com, *.publicnode.com, *.drpc.org, 1rpc.io/eth) and an INDEXER_URL, carrying an etherscan-style txlist query against a hardcoded wallet address 0xa322E5f3... and custom x-payload-* headers. Response content is stashed into process globals (_t_u, _t_s, _H, _H2) that are then consumed by a child_process.spawn call, giving the operator of the indexer remote code execution on the installer's machine at import time. The combination of typosquatted name, obfuscator.io packing of the main entry, hardcoded remote endpoints acting as a command channel, and spawn of a fetched payload is a supply-chain trojan disguised as a Tailwind plugin. ## Source: ghsa-malware (a6360dfe9a149abb217abe22c0f48a3c37dffdc5b8ed3fb0e637a72cae6efbfc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotate",
    "evidence": "osv:MAL-2026-16282",
    "products": [
      {
        "name": {
          "value": "tailwindcss-form",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.5.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-16282",
      "aliases": [
        "GHSA-c8m9-qwg6-5cv9",
        "MAL-2026-16282"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tailwindcss-form",
            "purl": "pkg:npm/tailwindcss-form",
            "ecosystem": "npm"
          },
          "versions": [
            "0.5.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form/MAL-2026-16282.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "src/index.js",
                  "tlsh": "9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34",
                  "sha256": "f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "1d7a68025e061178406620b4843137ca0118dcf7",
                    "sha512_sri": "sha512-TPe4D+Ulrp4xP9svNKW1ZEbV/67x3xTUrj7clWHIxWnd5uPnPsTNuYo9N/4nJlk8l+YOS3nBAifq+tA3QhlBDg=="
                  },
                  "filename": "tailwindcss-form-0.5.1.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-15T08:45:05.342136087Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/tailwindcss-form/v/0.5.1",
        "https://github.com/advisories/GHSA-c8m9-qwg6-5cv9"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020179",
            "sha256": "f5c6b39e2bde3263d10e2f20e707d06b981e746fda83ef7772233db33ae7a4f2",
            "source": "amazon-inspector",
            "versions": [
              "0.5.1"
            ],
            "import_time": "2026-09-18T04:43:03.811978749Z",
            "modified_time": "2026-09-18T04:31:16Z"
          },
          {
            "id": "GHSA-c8m9-qwg6-5cv9",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "a6360dfe9a149abb217abe22c0f48a3c37dffdc5b8ed3fb0e637a72cae6efbfc",
            "source": "ghsa-malware",
            "import_time": "2026-10-15T08:34:11.901805343Z",
            "modified_time": "2026-10-15T07:43:14Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 326267,
  "published_at": "2026-09-18T04:31:16+00:00"
}