{"id":"MAL-2026-15925","summary":"Malicious code in tailwind-contact-forms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50)\ntailwind-contact-forms ships src/index.js containing the legitimate @tailwindcss/forms plugin source concatenated with an obfuscator.io-style payload (rotating 328-entry string array _0x303e with decoder _0x1574, ~1300 deobfuscation transforms). The obfuscated section decodes to host-reconnaissance strings ('hostname', 'Win64; x64', 'process.env') and to network destinations targeting Ethereum RPC / block-explorer infrastructure ('h.drpc.org', 'pc.io/eth', an 'stapi.io' host, 'ut.com/api', and Etherscan-style query parameters '?module=account&action=txlist&', 'nonce', 'startbloc'). Because src/index.js is the package's main entry, the payload executes on require() in any project that installs this package. The package manifest declares repository = https://github.com/tailwindlabs/tailwindcss-forms (the real Tailwind Labs upstream, whose actual npm name is @tailwindcss/forms) while publishing under the unrelated name tailwind-contact-forms, impersonating the upstream to lure developers who mistype the real package. A CSS/Tailwind plugin has no functional reason to run obfuscated code, read host identifiers and process.env, or contact Ethereum RPC and block-explorer APIs at import time.\n","modified":"2026-09-04T07:00:09.419447041Z","published":"2026-09-04T06:48:54Z","database_specific":{"malicious-packages-origins":[{"versions":["0.5.12"],"id":"IN-MAL-2026-019640","import_time":"2026-09-04T06:53:31.795019554Z","modified_time":"2026-09-04T06:48:54Z","sha256":"0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.12"}],"affected":[{"package":{"name":"tailwind-contact-forms","ecosystem":"npm","purl":"pkg:npm/tailwind-contact-forms"},"versions":["0.5.12"],"database_specific":{"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"901605dc8863d7b3ad4b767d27847881c70a6d9ccb96dc6f3e2a40db779bfb02","tlsh":"b103c906bac13571234b5f7b760bf4e4e02e2d9d7698048bd129bc94f961329d8e2b39"},{"sha256":"5c99aaa1c44832939389b4f27a7b10aec4d559021aab7d02d031fe80ea536e6d","tlsh":"dc21cb26cd140e7701e0693696f911837297a463895cfc193396c19c8f8d6bfe0f909f","path":"package.json"}],"package_integrity":[{"filename":"tailwind-contact-forms-0.5.12.tgz","hashes":{"sha1":"dfd4597f50aaab8541f224eea73f4adb8be386d4","sha512_sri":"sha512-RfKyVBSVuj9Z8lmXNd6W3GDsPWyHRONhWLLxnVN40JwVbsik7EUvftW8FVV938YdtpDWolC3vQqzc9zP2IDDiA=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}