MAL-2026-12221

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-custom-forms/MAL-2026-12221.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12221

Published

2026-08-05T09:05:24Z

Modified

2026-08-05T10:06:31.179895377Z

Summary

Malicious code in tailwind-custom-forms (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2)

The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at github.com/tailwindlabs/tailwindcss-forms and src/index.js contains a verbatim copy of that legitimate plugin. Appended after module.exports = forms; is eval(atob('<large base64 blob>')), which decodes and executes on any require('tailwind-custom-forms'). The decoded payload reconstructs the module names http, https, zlib, url, and child_process from \u escapes to hide its imports, uses child_process.spawn, and builds outbound HTTP requests with keep-alive agents to hosts resolved at runtime from Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) keyed off the hardcoded ETH address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, calling paths /0x/cls and /0x/ls. On-chain records act as a rotating dispatcher so the operator can update C2 hosts without republishing the package. Requiring this module executes attacker-controlled code on the installer's machine.

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2",
            "source": "amazon-inspector",
            "versions": [
                "0.5.2"
            ],
            "import_time": "2026-08-05T09:28:23.654684155Z",
            "modified_time": "2026-08-05T09:05:24Z",
            "id": "IN-MAL-2026-014540"
        }
    ]
}

References

https://www.npmjs.com/package/tailwind-custom-forms/v/0.5.2

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / tailwind-custom-forms

Package

Name: tailwind-custom-forms; View open source insights on deps.dev
Purl: pkg:npm/tailwind-custom-forms

Affected ranges

Affected versions

0.*

0.5.2

Database specific

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "a486e81c28189214c1a78595d195ba2caf22cedb",
                "sha512_sri": "sha512-GQ4E6UQIh2iGL1Owhm3LTKz47qFOjOtWoxoD8dlsrbuF/q/5VbDdWgXhxUxfOIyyVQA9pExqMWuikg8Q83YJKg=="
            },
            "filename": "tailwind-custom-forms-0.5.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "47ce2da0014e4946fe38333dab062eefcdf627eb2d55b681c0cc0920566c1414",
            "tlsh": "6492a5965212372fef17883af9cb9b9c23345071a3ec1b80e057d8756bc9a84755aa0f"
        },
        {
            "path": "package.json",
            "sha256": "94bdbbf2780fffd9e4a319671bb8abcadd9e70ce71449962da7b3b090fdb0235",
            "tlsh": "1521c826cd140e7701e0293596f9118372a7a463895cfc193386c19c8f8d6bfe0fa09f"
        }
    ]
}

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-custom-forms/MAL-2026-12221.json"