{"id":"MAL-2026-16251","summary":"Malicious code in tailwindcss-contact-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b)\nPackage presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.\n","modified":"2026-09-17T14:30:05.362966038Z","published":"2026-09-17T14:16:40Z","database_specific":{"malicious-packages-origins":[{"versions":["0.5.1"],"id":"IN-MAL-2026-020120","import_time":"2026-09-17T14:20:23.161698178Z","modified_time":"2026-09-17T14:16:40Z","sha256":"0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-form/v/0.5.1"}],"affected":[{"package":{"name":"tailwindcss-contact-form","ecosystem":"npm","purl":"pkg:npm/tailwindcss-contact-form"},"versions":["0.5.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"tailwindcss-contact-form-0.5.1.tgz","hashes":{"sha512_sri":"sha512-KKFOm8kF/qxxkIW8BwSvwCNmszsN2T573UvFFZT8mjgpfMY7sVg4K8O1QBkZJF+OWGeDhhtMDcyqCe35FTXx4A==","sha1":"1b85b6533839b12a1f10cc8baa609d324412a433"}}],"evidence_files":[{"sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34","path":"src/index.js"},{"sha256":"b8a15fdbb763bf7f22700668956964130dcd94e6aa8c946c9c530461b29b283d","tlsh":"7721a622cd180e7302e0693596f905837297a463895cf8193396c19ccf8d6bfe0f909f","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-form/MAL-2026-16251.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}