{"id":"MAL-2026-19145","summary":"Malicious code in tailwindcss-hook-forms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef)\nThe package impersonates @tailwindcss/forms: name, repository (tailwindlabs/tailwindcss-forms), author (@tailwindcss), README, CHANGELOG, and HTML are copied from the legitimate plugin, with a demo link to tailwindcss-hook-forms.vercel.app. src/index.js prepends a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor via peel.constructor and immediately invokes a function compiled from a ~15KB opaque, obfuscated string literal, passing the host require into it. This fires whenever any consumer imports the package, running attacker-controlled code in the installer's Node.js process with full access to require, process, filesystem, and network. The subsequent code replicates the public API of @tailwindcss/forms as cover. The obfuscator scheme does not exist in the legitimate plugin and its only purpose is to conceal the executable body from review.\n","modified":"2026-11-11T21:15:16.215930452Z","published":"2026-11-11T20:55:10Z","database_specific":{"malicious-packages-origins":[{"sha256":"d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef","source":"amazon-inspector","versions":["0.5.2"],"id":"IN-MAL-2026-022601","import_time":"2026-11-11T21:05:23.027300784Z","modified_time":"2026-11-11T20:55:10Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-hook-forms/v/0.5.2"}],"affected":[{"package":{"name":"tailwindcss-hook-forms","ecosystem":"npm","purl":"pkg:npm/tailwindcss-hook-forms"},"versions":["0.5.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-hook-forms/MAL-2026-19145.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"89b24b2b3413033bb9138c784adaa8f0760db01577b4c3e5f4ad80b05f8a5e8a576e9d","path":"src/index.js","sha256":"860f4933ca8ff3d4b7b09fb1d4eab7caaf69dc5ab5f9f04193040a921ff265ae"},{"tlsh":"e121a526cd140e7302d0283596f90183b2979863895cbc193396c19c8f8d5bfe0fa09e","path":"package.json","sha256":"3970683d138585b1304ade506824ff3754de3432470db6f8d31025e122790f9e"}],"package_integrity":[{"hashes":{"sha1":"0ee686bb29beeea912396b45341877f03dd9fe70","sha512_sri":"sha512-ZflHPkmXX3GuqTZaZMKV7WCle3GYJ/AMnX/AJ2x+NE+ZHa9L8xs8F6FeJrpFEgm/hdvLd5DMxdihZDd3TH2VCw=="},"filename":"tailwindcss-hook-forms-0.5.2.tgz"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}