MAL-2026-15636

Dashboard / Malicious Package / MAL-2026-15636

MAL-2026-15636

Summary: Malicious code in tailwindcss-forms-style (npm)

Details: Source: amazon-inspector (8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2) Package typosquats @tailwindcss/forms. On require('tailwindcss-forms-style'), src/index.js runs eval(atob(...)) on a base64 blob appended after module.exports. The decoded payload queries public Ethereum RPC endpoints (1rpc.io, eth.drpc.org, publicnode, blastapi, eth.blockscout.com) for the latest transaction from hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes an IP address from the transaction's `to` field, then fetches XOR-encrypted payloads from that host at http://<ip>:443/0x/cls and http://<ip>:443/0x/ls (XOR keys 'q4FZkxX{!h,Sr3=@' and 'y-p_>d$0B&@^1aQk'), and executes them via eval() and a detached spawn('node','-e',...) child process. Immediately after the eval runs, src/index.js rewrites itself with fs.writeFileSync(__filename,...) to remove the eval block, so later inspection of the file on disk shows only benign tailwind plugin code. The combination provides arbitrary remote code execution in the installer's Node process, a detached persistent child, an attacker-controlled command channel resilient to takedown (C2 IP rotated via on-chain transactions), and anti-forensic self-erasure.

References: https://www.npmjs.com/package/tailwindcss-forms-style/v/0.1.2