MAL-2026-16139
Malicious code in tailwind-form-kit (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cccb2aed2f968e146b433d2a2600f17104f0dcacfd951190771f8e59aee3a252) tailwind-form-kit@0.6.4 impersonates @tailwindcss/forms (package.json sets repository to https://github.com/tailwindlabs/tailwindcss-forms) but src/index.js is a heavily obfuscated single-line loader (obfuscator.io string-array shape, all identifiers _0xNNNN). On require() — as would happen when the package is referenced from tailwind.config — the loader opens HTTP/HTTPS to Ethereum public RPCs (publicnode, drpc.org/eth, blockscout) and an Etherscan-like indexer at *stapi.io, queries a hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a via eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, extracts a base64/gzip/deflate/br-encoded payload from an x-payload-B64 header or transaction data, and invokes child_process.spawn('node',...) on the retrieved bytes. This is the EtherHiding fetch-and-exec pattern: the on-chain address acts as a mutable C2 pointer, and any developer or build machine that requires this package runs whatever code the attacker currently points it at. A CSS forms plugin has no legitimate reason to talk to Ethereum RPCs or spawn node on fetched bytes.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwind-form-kit (npm). Pin to a known-safe version or switch to an alternative.