tailwind-input-kit

{"schema_version":"1.7.4","id":"MAL-2026-18595","published":"2026-11-04T00:24:48Z","modified":"2026-11-04T07:39:27.392824431Z","aliases":["GHSA-w4jv-38cq-v2wm"],"summary":"Malicious code in tailwind-input-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (630101a331666e0b23f3bf13fc5b6390d361ccc4be631c55f6ea29d10f3f7711)\nThe package impersonates @tailwindcss/forms (name 'tailwind-input-kit', author.name '@tailwindcss', repository pointing to github.com/tailwindlabs/tailwindcss-forms, with README/HTML/CHANGELOG copied from the official plugin) while prepending a malicious loader to src/index.js. The file begins with eval(atob('<~50KB base64 blob>')) that executes before any legitimate plugin code is reached on require(). The decoded blob is a heavily _0x-obfuscated loader that imports node:http, node:https, node:zlib, and node:child_process (spawn), reconstructs destinations from an obfuscated string array (including an api endpoint on an external host, Ethereum JSON-RPC endpoints such as publicnode and drpc.org, and Etherscan-style txlist queries parameterized by hardcoded 0x addresses), issues outbound HTTPS requests carrying a custom 'x-payload-' header, decompresses gzip/brotli/deflate responses, and hands the resulting JavaScript to eval ('[eval]' marker present). The loader additionally spawns a child 'node' process with stdin piping, injects the parent's require and module into globals (global.r, global.m, global._H, global._H2, global._V, _t_s, _t_u), and feeds the fetched second-stage script into that child — giving the remote operator full code execution on the installer's host on every require(), with the ability to deliver new payloads at will. The retained tailwindcss-forms plugin code after the eval() serves as cover for a cursory read.\n\n## Source: ghsa-malware (6494a1e8a2c80262deac2480044bfa5a1f823651eb4a812376d6fb5af521ce87)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"tailwind-input-kit","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.5.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"5b86d3e60cef86f314f5e279037bea95342b02f957ceda1c69f115066aeba24e","tlsh":"38433b76435e2addad2dcc00fbb9c5790305a4370036eacb896ebdac395e09f2046d67"}]}}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w4jv-38cq-v2wm"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-input-kit/v/0.5.5"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-w4jv-38cq-v2wm","import_time":"2026-11-04T00:37:30.076637096Z","modified_time":"2026-11-04T00:24:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"6494a1e8a2c80262deac2480044bfa5a1f823651eb4a812376d6fb5af521ce87","source":"ghsa-malware"},{"id":"IN-MAL-2026-022539","import_time":"2026-11-04T07:37:35.305491494Z","modified_time":"2026-11-04T07:35:21Z","sha256":"630101a331666e0b23f3bf13fc5b6390d361ccc4be631c55f6ea29d10f3f7711","source":"amazon-inspector","versions":["0.5.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}