{"id":"MAL-2026-15925","summary":"Malicious code in tailwind-contact-forms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5)\nThe package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at tailwindlabs/tailwindcss-forms, while the actual main entry src/index.js is a heavily obfuscated Node loader (obfuscator.io-style rotated string array _0x18ab with 303 entries, decoder _0x35ba, control-flow-object dispatch). On require(), the loader constructs an Etherscan-style indexer URL and Ethereum JSON-RPC endpoint list (eth.blockscout, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) from decoded string fragments, queries eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount and the txlist API for hardcoded attacker addresses (0xa322E5f3...9aDC2490Ef and 0x...D311D3080e...6f0121063e), and assembles a runtime code payload injected via global['_V...']/global['_t_u']/global['_t_s']/global['_H']/global['_H2']. The loader imports node:child_process.spawn to execute the retrieved payload. This is the EtherHiding pattern: the attacker updates transaction data on-chain to rotate second-stage code without republishing the package, and every consumer that loads tailwind-contact-forms in their tailwind.config.js executes whatever the attacker's on-chain transaction currently points to. A Tailwind plugin has no legitimate need for obfuscation, Ethereum RPC access, block-explorer indexers, or child_process spawning.\n","modified":"2026-10-05T16:31:38.359344811Z","published":"2026-09-04T06:48:54Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-04T06:48:54Z","sha256":"0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50","source":"amazon-inspector","versions":["0.5.12"],"id":"IN-MAL-2026-019640","import_time":"2026-09-04T06:53:31.795019554Z"},{"versions":["0.5.1"],"id":"IN-MAL-2026-020492","import_time":"2026-09-23T14:19:31.892811335Z","modified_time":"2026-09-23T14:10:59Z","sha256":"6d82b6065d9e3d4a4ebba479ed42deb342f72c48d2d69d297f3926c0225828aa","source":"amazon-inspector"},{"versions":["0.5.5"],"id":"IN-MAL-2026-020786","import_time":"2026-09-30T01:36:51.449031654Z","modified_time":"2026-09-30T01:27:40Z","sha256":"956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5","source":"amazon-inspector"},{"import_time":"2026-10-05T16:22:57.008828579Z","modified_time":"2026-10-05T16:14:44Z","sha256":"36808a08f61e6af080a534ddf1387767136fbd9b35257ab945fe8881f04a43e4","source":"amazon-inspector","versions":["0.5.9"],"id":"IN-MAL-2026-021079"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.9"}],"affected":[{"package":{"name":"tailwind-contact-forms","ecosystem":"npm","purl":"pkg:npm/tailwind-contact-forms"},"versions":["0.5.12","0.5.1","0.5.5","0.5.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"tailwind-contact-forms-0.5.12.tgz","hashes":{"sha1":"dfd4597f50aaab8541f224eea73f4adb8be386d4","sha512_sri":"sha512-RfKyVBSVuj9Z8lmXNd6W3GDsPWyHRONhWLLxnVN40JwVbsik7EUvftW8FVV938YdtpDWolC3vQqzc9zP2IDDiA=="}}],"evidence_files":[{"path":"src/index.js","sha256":"901605dc8863d7b3ad4b767d27847881c70a6d9ccb96dc6f3e2a40db779bfb02","tlsh":"b103c906bac13571234b5f7b760bf4e4e02e2d9d7698048bd129bc94f961329d8e2b39"},{"path":"package.json","sha256":"5c99aaa1c44832939389b4f27a7b10aec4d559021aab7d02d031fe80ea536e6d","tlsh":"dc21cb26cd140e7701e0693696f911837297a463895cfc193396c19c8f8d6bfe0f909f"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}