tailwindcss-contact-forms

{"schema_version":"1.7.4","id":"MAL-2026-16124","published":"2026-09-10T18:05:11Z","modified":"2026-09-14T16:21:07.928940644Z","summary":"Malicious code in tailwindcss-contact-forms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30)\nThe package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process — a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.\n","affected":[{"package":{"name":"tailwindcss-contact-forms","ecosystem":"npm"},"versions":["0.5.8","0.5.6","0.5.5","0.5.4","0.5.9","0.6.0","0.5.7","0.6.1","0.6.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"96f6f69831f631dd4d054f9ef51706445b3db58ffd78f0e2090786a35dae7c37","tlsh":"510309017e80251627074e77b75bf0d0f10e4d8d74d848cad218bca4faa57a6e5f2b76"},{"path":"package.json","sha256":"1fb8f187e61a11f9cf5b2b0c1bf1e537e910f1ba6f85641605797a1126e545b1","tlsh":"ac219426cd140e7701e0693596f901837297a463895cf8193396c19c8f8d6bfa0fa09f"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.6.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.6.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.6.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019927","import_time":"2026-09-10T18:20:41.88591018Z","modified_time":"2026-09-10T18:05:28Z","sha256":"297b6067187ab46efa382926811e477c44ba6cc43ec73857cd82a029dbd4f143","source":"amazon-inspector","versions":["0.5.8"]},{"id":"IN-MAL-2026-019928","import_time":"2026-09-10T18:20:41.937972455Z","modified_time":"2026-09-10T18:05:38Z","sha256":"de214bf61202227c4cb55d5d694a713db6b5d1be37d8ab405490e83b30a4cc66","source":"amazon-inspector","versions":["0.5.6"]},{"id":"IN-MAL-2026-019925","import_time":"2026-09-10T18:20:41.81874445Z","modified_time":"2026-09-10T18:05:11Z","sha256":"43fbb7bac749e4d8b427e71a65cb023073da42bce730bc4d14b7c790bc1ee825","source":"amazon-inspector","versions":["0.5.5"]},{"id":"IN-MAL-2026-019929","import_time":"2026-09-10T18:20:41.96802671Z","modified_time":"2026-09-10T18:05:47Z","sha256":"4f67d5140640ce71a71be6d18d85c5069df64a926a2e9e5a41380c94039242c9","source":"amazon-inspector","versions":["0.5.4"]},{"id":"IN-MAL-2026-019931","import_time":"2026-09-10T18:20:42.072448518Z","modified_time":"2026-09-10T18:06:02Z","sha256":"89b3c4a5af676eb6eaddab75e26223a6740de56199e769148a0b5c1ed3d25c36","source":"amazon-inspector","versions":["0.5.9"]},{"id":"IN-MAL-2026-019935","import_time":"2026-09-10T18:20:42.298193533Z","modified_time":"2026-09-10T18:06:38Z","sha256":"cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30","source":"amazon-inspector","versions":["0.6.0"]},{"id":"IN-MAL-2026-019926","import_time":"2026-09-10T18:20:41.854715421Z","modified_time":"2026-09-10T18:05:22Z","sha256":"d0afcb1e0184276d3bfa609dccad2c2d417f065ad8cb3db832cca14ce27d9239","source":"amazon-inspector","versions":["0.5.7"]},{"id":"IN-MAL-2026-020009","import_time":"2026-09-11T23:15:29.548461231Z","modified_time":"2026-09-11T22:37:36Z","sha256":"56b5020fd066a5f1fea72f976fbfc0fc88907571c54d58596d389a8ead01c20c","source":"amazon-inspector","versions":["0.6.1"]},{"id":"IN-MAL-2026-020018","import_time":"2026-09-14T16:19:11.936205693Z","modified_time":"2026-09-14T15:41:48Z","sha256":"aac7c18e5852ce379f645560021e1699f1201f666e80a0d0011145ed445103ca","source":"amazon-inspector","versions":["0.6.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}