MAL-2026-16124

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-forms/MAL-2026-16124.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16124
Published
2026-09-10T18:05:11Z
Modified
2026-09-11T23:30:06Z
Summary
Malicious code in tailwindcss-contact-forms (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30)

The package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process — a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019927",
            "import_time": "2026-09-10T18:20:41.88591018Z",
            "modified_time": "2026-09-10T18:05:28Z",
            "sha256": "297b6067187ab46efa382926811e477c44ba6cc43ec73857cd82a029dbd4f143",
            "source": "amazon-inspector",
            "versions": [
                "0.5.8"
            ]
        },
        {
            "id": "IN-MAL-2026-019928",
            "import_time": "2026-09-10T18:20:41.937972455Z",
            "modified_time": "2026-09-10T18:05:38Z",
            "sha256": "de214bf61202227c4cb55d5d694a713db6b5d1be37d8ab405490e83b30a4cc66",
            "source": "amazon-inspector",
            "versions": [
                "0.5.6"
            ]
        },
        {
            "id": "IN-MAL-2026-019925",
            "import_time": "2026-09-10T18:20:41.81874445Z",
            "modified_time": "2026-09-10T18:05:11Z",
            "sha256": "43fbb7bac749e4d8b427e71a65cb023073da42bce730bc4d14b7c790bc1ee825",
            "source": "amazon-inspector",
            "versions": [
                "0.5.5"
            ]
        },
        {
            "id": "IN-MAL-2026-019929",
            "import_time": "2026-09-10T18:20:41.96802671Z",
            "modified_time": "2026-09-10T18:05:47Z",
            "sha256": "4f67d5140640ce71a71be6d18d85c5069df64a926a2e9e5a41380c94039242c9",
            "source": "amazon-inspector",
            "versions": [
                "0.5.4"
            ]
        },
        {
            "id": "IN-MAL-2026-019931",
            "import_time": "2026-09-10T18:20:42.072448518Z",
            "modified_time": "2026-09-10T18:06:02Z",
            "sha256": "89b3c4a5af676eb6eaddab75e26223a6740de56199e769148a0b5c1ed3d25c36",
            "source": "amazon-inspector",
            "versions": [
                "0.5.9"
            ]
        },
        {
            "id": "IN-MAL-2026-019935",
            "import_time": "2026-09-10T18:20:42.298193533Z",
            "modified_time": "2026-09-10T18:06:38Z",
            "sha256": "cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30",
            "source": "amazon-inspector",
            "versions": [
                "0.6.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019926",
            "import_time": "2026-09-10T18:20:41.854715421Z",
            "modified_time": "2026-09-10T18:05:22Z",
            "sha256": "d0afcb1e0184276d3bfa609dccad2c2d417f065ad8cb3db832cca14ce27d9239",
            "source": "amazon-inspector",
            "versions": [
                "0.5.7"
            ]
        },
        {
            "id": "IN-MAL-2026-020009",
            "import_time": "2026-09-11T23:15:29.548461231Z",
            "modified_time": "2026-09-11T22:37:36Z",
            "sha256": "56b5020fd066a5f1fea72f976fbfc0fc88907571c54d58596d389a8ead01c20c",
            "source": "amazon-inspector",
            "versions": [
                "0.6.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwindcss-contact-forms

Package

Name
tailwindcss-contact-forms
View open source insights on deps.dev
Purl
pkg:npm/tailwindcss-contact-forms

Affected ranges

Affected versions

0.*
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "96f6f69831f631dd4d054f9ef51706445b3db58ffd78f0e2090786a35dae7c37",
            "tlsh": "510309017e80251627074e77b75bf0d0f10e4d8d74d848cad218bca4faa57a6e5f2b76"
        },
        {
            "path": "package.json",
            "sha256": "1fb8f187e61a11f9cf5b2b0c1bf1e537e910f1ba6f85641605797a1126e545b1",
            "tlsh": "ac219426cd140e7701e0693596f901837297a463895cf8193396c19c8f8d6bfa0fa09f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-forms/MAL-2026-16124.json"