MAL-2026-14195
Malicious code in tailwind-custom-templates (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720) The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an obfuscator.io-generated payload (rotated 303-entry string array, inline decoder wrappers) that decodes to Ethereum-related network activity. The payload contains hardcoded references to an Ethereum RPC provider (drpc.org), an Etherscan-style API (query string '?module=ac'), additional remote hosts, HTTP request assembly primitives (headers, Content-Length, JSON.stringify, User-Agent 'like Gecko'), and a hardcoded ETH address (0xa322E5f3...). src/index.js is the package's main entry, so this code runs on require/import. The declared purpose (Tailwind CSS form styles) has no need for Ethereum RPC or Etherscan traffic, and the package name 'tailwind-custom-templates' does not match the bundled tailwindcss-forms source or the referenced tailwindlabs repository, indicating masquerade. The combination of a hardcoded ETH address with on-chain RPC/explorer endpoints is consistent with a wallet-address-swap/clipper or on-chain C2 that runs on the installer's machine at import time.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-custom-templates (npm). Pin to a known-safe version or switch to an alternative.