MAL-2026-15925

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15925
Published
2026-09-04T06:48:54Z
Modified
2026-09-23T14:30:05Z
Summary
Malicious code in tailwind-contact-forms (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6d82b6065d9e3d4a4ebba479ed42deb342f72c48d2d69d297f3926c0225828aa)

The package's main module src/index.js begins with eval(atob("...")) that decodes ~30 KB of obfuscated JavaScript before the genuine plugin code. The decoded loader imports http/https/zlib and child_process.spawn, hoists require and module onto globals (global['r'], global['m']) to escape the module sandbox, and evaluates payloads received from remote endpoints. The loader hardcodes an Ethereum sender address (assembled from fragments including '0xa322E5f3','D311D3080e','6f0121063e') and a set of RPC endpoints on public Ethereum nodes (drpc.org, publicnode.com, blockscout, ethereum-rpc) plus an Etherscan-style indexer queried with 'module=account&action=txlist&address=...&sort=desc'. It polls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount to monitor the on-chain address and retrieves payloads carried in x-payload-b64 headers, decompressed through zlib createGunzip/createInflate and executed. The loader fires on any require('tailwind-contact-forms'). The package name mimics @tailwindcss/forms and its package.json repository field points at https://github.com/tailwindlabs/tailwindcss-forms; the obfuscated loader is prepended above a verbatim copy of the legitimate @tailwindcss/forms plugin source so the package appears to work normally after infection.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019640",
            "import_time":  "2026-09-04T06:53:31.795019554Z",
            "modified_time":  "2026-09-04T06:48:54Z",
            "sha256":  "0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50",
            "source":  "amazon-inspector",
            "versions":  [
                "0.5.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-020492",
            "import_time":  "2026-09-23T14:19:31.892811335Z",
            "modified_time":  "2026-09-23T14:10:59Z",
            "sha256":  "6d82b6065d9e3d4a4ebba479ed42deb342f72c48d2d69d297f3926c0225828aa",
            "source":  "amazon-inspector",
            "versions":  [
                "0.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-contact-forms

Package

Name
tailwind-contact-forms
View open source insights on deps.dev
Purl
pkg:npm/tailwind-contact-forms

Affected ranges

Affected versions

0.*
0.5.1
0.5.12

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/index.js",
            "sha256":  "901605dc8863d7b3ad4b767d27847881c70a6d9ccb96dc6f3e2a40db779bfb02",
            "tlsh":  "b103c906bac13571234b5f7b760bf4e4e02e2d9d7698048bd129bc94f961329d8e2b39"
        },
        {
            "path":  "package.json",
            "sha256":  "5c99aaa1c44832939389b4f27a7b10aec4d559021aab7d02d031fe80ea536e6d",
            "tlsh":  "dc21cb26cd140e7701e0693696f911837297a463895cfc193396c19c8f8d6bfe0f909f"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "tailwind-contact-forms-0.5.12.tgz",
            "hashes":  {
                "sha1":  "dfd4597f50aaab8541f224eea73f4adb8be386d4",
                "sha512_sri":  "sha512-RfKyVBSVuj9Z8lmXNd6W3GDsPWyHRONhWLLxnVN40JwVbsik7EUvftW8FVV938YdtpDWolC3vQqzc9zP2IDDiA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json"