MAL-2026-14195

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-custom-templates/MAL-2026-14195.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-14195

Published

2026-08-19T01:17:13Z

Modified

2026-08-19T01:45:11.483270142Z

Summary

Malicious code in tailwind-custom-templates (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720)

The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an obfuscator.io-generated payload (rotated 303-entry string array, inline decoder wrappers) that decodes to Ethereum-related network activity. The payload contains hardcoded references to an Ethereum RPC provider (drpc.org), an Etherscan-style API (query string '?module=ac'), additional remote hosts, HTTP request assembly primitives (headers, Content-Length, JSON.stringify, User-Agent 'like Gecko'), and a hardcoded ETH address (0xa322E5f3...). src/index.js is the package's main entry, so this code runs on require/import. The declared purpose (Tailwind CSS form styles) has no need for Ethereum RPC or Etherscan traffic, and the package name 'tailwind-custom-templates' does not match the bundled tailwindcss-forms source or the referenced tailwindlabs repository, indicating masquerade. The combination of a hardcoded ETH address with on-chain RPC/explorer endpoints is consistent with a wallet-address-swap/clipper or on-chain C2 that runs on the installer's machine at import time.

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720",
            "modified_time": "2026-08-19T01:17:13Z",
            "versions": [
                "0.7.2"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018276",
            "import_time": "2026-08-19T01:34:41.660185503Z"
        }
    ]
}

References

https://www.npmjs.com/package/tailwind-custom-templates/v/0.7.2

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / tailwind-custom-templates

Package

Name: tailwind-custom-templates; View open source insights on deps.dev
Purl: pkg:npm/tailwind-custom-templates

Affected ranges

Affected versions

0.*

0.7.2

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-custom-templates/MAL-2026-14195.json"

indicators

{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "7a29d1deb0eaa8ada4e778028d27a054bec5e6389ecd7120b847646404a734bd",
            "tlsh": "f103d485b7d0a411130b5abfb75ff8f4e95e0cac75c00ac6d019f994e8a6326e8f2935"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "f78020e41746ba04c76eb73b950fc42256c81872",
                "sha512_sri": "sha512-su3SifQQwlacB6LQAqkJx8LYwXcGzyJdZnld4bANtvMLyavkvEMKzYaupr+wstBjrBcI85nKwE09Xx73yG8o2A=="
            },
            "filename": "tailwind-custom-templates-0.7.2.tgz"
        }
    ]
}