MAL-2026-14195

    Dashboard / Malicious Package / MAL-2026-14195

    MAL-2026-14195

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in tailwind-custom-templates (npm)

    Details: Source: amazon-inspector (d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720) The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an obfuscator.io-generated payload (rotated 303-entry string array, inline decoder wrappers) that decodes to Ethereum-related network activity. The payload contains hardcoded references to an Ethereum RPC provider (drpc.org), an Etherscan-style API (query string '?module=ac'), additional remote hosts, HTTP request assembly primitives (headers, Content-Length, JSON.stringify, User-Agent 'like Gecko'), and a hardcoded ETH address (0xa322E5f3...). src/index.js is the package's main entry, so this code runs on require/import. The declared purpose (Tailwind CSS form styles) has no need for Ethereum RPC or Etherscan traffic, and the package name 'tailwind-custom-templates' does not match the bundled tailwindcss-forms source or the referenced tailwindlabs repository, indicating masquerade. The combination of a hardcoded ETH address with on-chain RPC/explorer endpoints is consistent with a wallet-address-swap/clipper or on-chain C2 that runs on the installer's machine at import time.

    References: https://www.npmjs.com/package/tailwind-custom-templates/v/0.7.2

    Affected packages

    Package

    Name: tailwind-custom-templates

    Purl: pkg:npm/tailwind-custom-templates

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.7.2
    MAL-2026-14195 | CVE-DB