MAL-2026-12221
Malicious code in tailwind-custom-forms (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2) The package impersonates @tailwindcss/forms: package.json declares the name `tailwind-custom-forms` while the repository field points at `github.com/tailwindlabs/tailwindcss-forms` and src/index.js contains a verbatim copy of that legitimate plugin. Appended after `module.exports = forms;` is `eval(atob('<large base64 blob>'))`, which decodes and executes on any `require('tailwind-custom-forms')`. The decoded payload reconstructs the module names `http`, `https`, `zlib`, `url`, and `child_process` from `\u` escapes to hide its imports, uses `child_process.spawn`, and builds outbound HTTP requests with keep-alive agents to hosts resolved at runtime from Ethereum JSON-RPC endpoints (`eth.blockscout.com/api`, `1rpc.io/eth`, `eth.drpc.org`, `ethereum-rpc.publicnode.com`, `eth-mainnet.public.blastapi.io`) keyed off the hardcoded ETH address `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a`, calling paths `/0x/cls` and `/0x/ls`. On-chain records act as a rotating dispatcher so the operator can update C2 hosts without republishing the package. Requiring this module executes attacker-controlled code on the installer's machine.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-custom-forms (npm). Pin to a known-safe version or switch to an alternative.