MAL-2026-16295

    Dashboard / Malicious Package / MAL-2026-16295

    MAL-2026-16295

    Published: 18 Sept 2026Last Modified: 18 Sept 2026

    Summary: Malicious code in tailwindcss-forms-ui (npm)

    Details: Source: amazon-inspector (6f2bdfef8937b1e6ef4979181693e00adbdfbe7521b8b240268f76beff8b3be8) The package name typosquats @tailwindcss/forms but its main entry src/index.js is a 39 KB obfuscator.io bundle (303-entry rotating string array, hex-named identifiers, control-flow flattening) with no Tailwind/CSS functionality. On require(), the module attaches require and module to global scope, then queries Ethereum JSON-RPC endpoints (eth.publicnode.com, 1rpc.io/eth, eth-mainnet.public.blastapi.io, eth.drpc.org) and Etherscan/Blockscout txlist APIs for transactions from the hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a, decompresses the returned transaction data (gzip/deflate/brotli), and passes it to code-construction and node:child_process.spawn sinks. The hardcoded sender's on-chain transactions are a mutable, attacker-controlled payload channel (EtherHiding pattern), granting arbitrary code execution on any installer that require()s the module.

    References: https://www.npmjs.com/package/tailwindcss-forms-ui/v/0.5.2

    Affected packages

    Package

    Name: tailwindcss-forms-ui

    Purl: pkg:npm/tailwindcss-forms-ui

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.5.2