MAL-2026-13923

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-form-templates/MAL-2026-13923.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13923
Published
2026-08-12T15:41:57Z
Modified
2026-08-12T16:03:34.325288218Z
Summary
Malicious code in tailwind-form-templates (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc)

The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an eval(atob(...)) payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's to field, fetches an XOR-encrypted command from that IP via an x-payload-b64 header, and executes the result through eval and a detached spawn('node', ['-e',...]). This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017619",
            "import_time": "2026-08-12T15:53:01.55159181Z",
            "sha256": "8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc",
            "modified_time": "2026-08-12T15:41:57Z",
            "source": "amazon-inspector",
            "versions": [
                "0.7.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-form-templates

Package

Name
tailwind-form-templates
View open source insights on deps.dev
Purl
pkg:npm/tailwind-form-templates

Affected ranges

Affected versions

0.*
0.7.4

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "tlsh": "6292a55b5112366fef1b193af8cbab9823285072a6ec1f80e057d470ab89dc4755f60f",
            "sha256": "83a0b7b595bdc1fd9927844f8eea61723d6b4a93b0867498bb878d47f2919fd0"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-form-templates-0.7.4.tgz",
            "hashes": {
                "sha1": "8e612359b762bae735774e85b1a42e95075abd60",
                "sha512_sri": "sha512-3BRFu5qXitkEvR/Xi0vN8IU4K05WDreqIqQXWreaIbcIvn8km4i84jkpPhT1uL/o3KVZbz0occnbs+M7TrhI2A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-form-templates/MAL-2026-13923.json"