tailwind-custom-templates

{"modified":"2026-08-19T01:17:13Z","published":"2026-08-19T01:17:13Z","schema_version":"1.7.4","id":"MAL-2026-14195","summary":"Malicious code in tailwind-custom-templates (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720)\nThe package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an obfuscator.io-generated payload (rotated 303-entry string array, inline decoder wrappers) that decodes to Ethereum-related network activity. The payload contains hardcoded references to an Ethereum RPC provider (drpc.org), an Etherscan-style API (query string '?module=ac'), additional remote hosts, HTTP request assembly primitives (headers, Content-Length, JSON.stringify, User-Agent 'like Gecko'), and a hardcoded ETH address (0xa322E5f3...). src/index.js is the package's main entry, so this code runs on require/import. The declared purpose (Tailwind CSS form styles) has no need for Ethereum RPC or Etherscan traffic, and the package name 'tailwind-custom-templates' does not match the bundled tailwindcss-forms source or the referenced tailwindlabs repository, indicating masquerade. The combination of a hardcoded ETH address with on-chain RPC/explorer endpoints is consistent with a wallet-address-swap/clipper or on-chain C2 that runs on the installer's machine at import time.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-custom-templates"},"versions":["0.7.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"7a29d1deb0eaa8ada4e778028d27a054bec5e6389ecd7120b847646404a734bd","tlsh":"f103d485b7d0a411130b5abfb75ff8f4e95e0cac75c00ac6d019f994e8a6326e8f2935"}],"package_integrity":[{"filename":"tailwind-custom-templates-0.7.2.tgz","hashes":{"sha1":"f78020e41746ba04c76eb73b950fc42256c81872","sha512_sri":"sha512-su3SifQQwlacB6LQAqkJx8LYwXcGzyJdZnld4bANtvMLyavkvEMKzYaupr+wstBjrBcI85nKwE09Xx73yG8o2A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-custom-templates/v/0.7.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018276","import_time":"2026-08-19T01:34:41.660185503Z","modified_time":"2026-08-19T01:17:13Z","sha256":"d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720","source":"amazon-inspector","versions":["0.7.2"]}]}}