MAL-2026-16295
Malicious code in tailwindcss-forms-ui (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6f2bdfef8937b1e6ef4979181693e00adbdfbe7521b8b240268f76beff8b3be8) The package name typosquats @tailwindcss/forms but its main entry src/index.js is a 39 KB obfuscator.io bundle (303-entry rotating string array, hex-named identifiers, control-flow flattening) with no Tailwind/CSS functionality. On require(), the module attaches require and module to global scope, then queries Ethereum JSON-RPC endpoints (eth.publicnode.com, 1rpc.io/eth, eth-mainnet.public.blastapi.io, eth.drpc.org) and Etherscan/Blockscout txlist APIs for transactions from the hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a, decompresses the returned transaction data (gzip/deflate/brotli), and passes it to code-construction and node:child_process.spawn sinks. The hardcoded sender's on-chain transactions are a mutable, attacker-controlled payload channel (EtherHiding pattern), granting arbitrary code execution on any installer that require()s the module.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tailwindcss-forms-ui (npm). Pin to a known-safe version or switch to an alternative.