MAL-2026-15925

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15925
Published
2026-09-04T06:48:54Z
Modified
2026-09-04T07:00:09.419447041Z
Summary
Malicious code in tailwind-contact-forms (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50)

tailwind-contact-forms ships src/index.js containing the legitimate @tailwindcss/forms plugin source concatenated with an obfuscator.io-style payload (rotating 328-entry string array _0x303e with decoder _0x1574, ~1300 deobfuscation transforms). The obfuscated section decodes to host-reconnaissance strings ('hostname', 'Win64; x64', 'process.env') and to network destinations targeting Ethereum RPC / block-explorer infrastructure ('h.drpc.org', 'pc.io/eth', an 'stapi.io' host, 'ut.com/api', and Etherscan-style query parameters '?module=account&action=txlist&', 'nonce', 'startbloc'). Because src/index.js is the package's main entry, the payload executes on require() in any project that installs this package. The package manifest declares repository = https://github.com/tailwindlabs/tailwindcss-forms (the real Tailwind Labs upstream, whose actual npm name is @tailwindcss/forms) while publishing under the unrelated name tailwind-contact-forms, impersonating the upstream to lure developers who mistype the real package. A CSS/Tailwind plugin has no functional reason to run obfuscated code, read host identifiers and process.env, or contact Ethereum RPC and block-explorer APIs at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T06:53:31.795019554Z",
            "id": "IN-MAL-2026-019640",
            "versions": [
                "0.5.12"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-04T06:48:54Z",
            "sha256": "0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50"
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-contact-forms

Package

Name
tailwind-contact-forms
View open source insights on deps.dev
Purl
pkg:npm/tailwind-contact-forms

Affected ranges

Affected versions

0.*
0.5.12

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-contact-forms/MAL-2026-15925.json"
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "tlsh": "b103c906bac13571234b5f7b760bf4e4e02e2d9d7698048bd129bc94f961329d8e2b39",
            "sha256": "901605dc8863d7b3ad4b767d27847881c70a6d9ccb96dc6f3e2a40db779bfb02"
        },
        {
            "path": "package.json",
            "tlsh": "dc21cb26cd140e7701e0693696f911837297a463895cfc193396c19c8f8d6bfe0f909f",
            "sha256": "5c99aaa1c44832939389b4f27a7b10aec4d559021aab7d02d031fe80ea536e6d"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwind-contact-forms-0.5.12.tgz",
            "hashes": {
                "sha1": "dfd4597f50aaab8541f224eea73f4adb8be386d4",
                "sha512_sri": "sha512-RfKyVBSVuj9Z8lmXNd6W3GDsPWyHRONhWLLxnVN40JwVbsik7EUvftW8FVV938YdtpDWolC3vQqzc9zP2IDDiA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]