{"id":"MAL-2026-16262","summary":"Malicious code in tailwindcss-form-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba05c76200656d6746f6f200e1e45f8027d4c87bb6b2312b9690aad262ddf39c)\ntailwindcss-form-ui@0.5.8 impersonates @tailwindcss/forms: package.json sets author to '@tailwindcss' and repository to https://github.com/tailwindlabs/tailwindcss-forms while publishing under an unrelated name, and the README and plugin source are verbatim copies of the real @tailwindcss/forms with a malicious preamble added. The declared main entry src/index.js prepends ~15 KB of obfuscated code to the copied plugin. A custom deterministic string-shuffle primitive (functions named spin/peel/splitLane with hardcoded seed arrays) reconstructs the identifiers 'constructor', 'require', 'module', and 'global' at runtime, then invokes the Function constructor on a decoded code blob and immediately calls the resulting function with require bound as a local parameter: Forge('z', peel('\u003cdecoded body\u003e'))(require). This executes attacker-controlled code with full Node module access the moment any consumer require()s the package. A Tailwind CSS plugin has no legitimate need to construct and run dynamically-decoded code at import time or to pass require into it; the obfuscation primitive exists only to hide the stager from static review.\n","modified":"2026-11-11T21:15:15.024670154Z","published":"2026-09-17T19:51:15Z","database_specific":{"malicious-packages-origins":[{"versions":["0.5.1"],"id":"IN-MAL-2026-020139","import_time":"2026-09-17T20:18:44.980237849Z","modified_time":"2026-09-17T19:51:15Z","sha256":"c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9","source":"amazon-inspector"},{"versions":["0.5.8"],"id":"IN-MAL-2026-022602","import_time":"2026-11-11T21:05:23.139955637Z","modified_time":"2026-11-11T20:55:16Z","sha256":"ba05c76200656d6746f6f200e1e45f8027d4c87bb6b2312b9690aad262ddf39c","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-form-ui/v/0.5.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-form-ui/v/0.5.8"}],"affected":[{"package":{"name":"tailwindcss-form-ui","ecosystem":"npm","purl":"pkg:npm/tailwindcss-form-ui"},"versions":["0.5.1","0.5.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form-ui/MAL-2026-16262.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"tailwindcss-form-ui-0.5.1.tgz","hashes":{"sha1":"6ad4e9d33db7ff1f025da8ee3be606323f0f48ca","sha512_sri":"sha512-pukhSsK+8SK6vgskhwNxkr5IlhRnIEtpu84CISV2zwKNY8gQ01l8NMMDCIdoKlUMFh16b+l9O23Fe0r/6H3wiQ=="}}],"evidence_files":[{"path":"src/index.js","sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"},{"tlsh":"a421c822cd140e7301e0293596f905837297a463895cf81a3396c19ccf8d6bfe0f909f","path":"package.json","sha256":"3d69860a60dfe83778e5d2fdf8e93d8cf796283d9832663ffe00ade9c8a6c79c"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}