{"id":"MAL-2026-16263","summary":"Malicious code in tailwindcss-form-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc)\nThe package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly.\n","modified":"2026-09-17T20:30:05.728274413Z","published":"2026-09-17T19:51:00Z","database_specific":{"malicious-packages-origins":[{"versions":["0.5.1"],"id":"IN-MAL-2026-020138","import_time":"2026-09-17T20:18:44.91394229Z","modified_time":"2026-09-17T19:51:00Z","sha256":"1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-form-utils/v/0.5.1"}],"affected":[{"package":{"name":"tailwindcss-form-utils","ecosystem":"npm","purl":"pkg:npm/tailwindcss-form-utils"},"versions":["0.5.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34","path":"src/index.js"},{"path":"package.json","sha256":"a7e0299ab34247362af50b02bcc93061d0432320fe4d066262aaeb88c1281ec2","tlsh":"bc21a622cd140e7302e0293596f905877297a463895cf81a3396c19c8f8d6bfe0fa09f"}],"package_integrity":[{"filename":"tailwindcss-form-utils-0.5.1.tgz","hashes":{"sha1":"77fb1c5ff05695a67340d629307ad65ccff6980f","sha512_sri":"sha512-Eg4EVI9O/Iq0vJsFTT0Kyhv9z+PARDTyFlX+jRSESnSBNkRfETa8sH7qrZ1C7Phd4QYbVSmTi4ScF1HmF/sXIQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form-utils/MAL-2026-16263.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}