{"id":"MAL-2026-17310","summary":"Malicious code in tailwind-forms-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea)\nnpm package tailwind-forms-kit@0.5.1 impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' (with a leading space), the README mirrors tailwindlabs/tailwindcss-forms, and the repository field points at the legitimate tailwindlabs/tailwindcss-forms repo. The shipped src/index.js (the package's main entry) is not a Tailwind plugin. It is a single-line obfuscator.io-obfuscated loader (string array _0x18ab with 303 entries, rotate/shift IIFE, decoder _0x35ba, hex-named variables) that at require() time imports node:http, node:https, node:zlib, and spawn from node:child_process. It reassembles at runtime a hardcoded Ethereum sender address (0xa322E5f39aDC2490EfD311D3080e6f0121063e1a) and a list of public Ethereum RPC endpoints and an Etherscan-style indexer URL (publicnode.com, 1rpc.io, drpc.org, blockscout) from string-array indices, queries the indexer for that sender's transaction list ('?module=ac...on=txlist&address=...'), reconstructs a payload from the returned on-chain transaction data, and hands the reconstructed bytes to node:child_process spawn / dynamic execution via global slots (_t_u, _t_s, _H, _H2). This is the EtherHiding blockchain-hosted-C2 pattern: whoever controls the sender address controls arbitrary code executed on any host that installs or requires the package, with no version pin, no hash verification, and blockchain-data transport chosen to evade domain and URL blocklists. The Tailwind branding, copied README, and misleading repository URL are cover for the loader.\n","modified":"2026-09-30T01:45:10.571093606Z","published":"2026-09-30T01:27:06Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.5.1"],"id":"IN-MAL-2026-020784","import_time":"2026-09-30T01:36:51.330327282Z","modified_time":"2026-09-30T01:27:06Z","sha256":"a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-forms-kit/v/0.5.1"}],"affected":[{"package":{"name":"tailwind-forms-kit","ecosystem":"npm","purl":"pkg:npm/tailwind-forms-kit"},"versions":["0.5.1"],"database_specific":{"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f","tlsh":"e103e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"},{"path":"package.json","sha256":"784b58f91fa2f86b78b05ba9b821c9957c7235f6f93c0ae9e4f9ebbfc9b94fd9","tlsh":"2821c822cd140e7302e0293596f90583b297a463895cf81d3396c19c8f8d6bfe0f909f"}],"package_integrity":[{"filename":"tailwind-forms-kit-0.5.1.tgz","hashes":{"sha1":"05ca49af22a2b65a8e6db502de6e79d92416785d","sha512_sri":"sha512-bNn+5PEe0Ngs0Xq0kda3levwwCehhf9/nAO65b7PZhtCKjsgh6ecXYV/U00kh53s74AB3lslH+oG0Se8D8axWQ=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-forms-kit/MAL-2026-17310.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}