MAL-2026-16139

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-form-kit/MAL-2026-16139.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16139
Published
2026-09-11T22:39:48Z
Modified
2026-09-11T23:30:06Z
Summary
Malicious code in tailwind-form-kit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cccb2aed2f968e146b433d2a2600f17104f0dcacfd951190771f8e59aee3a252)

tailwind-form-kit@0.6.4 impersonates @tailwindcss/forms (package.json sets repository to https://github.com/tailwindlabs/tailwindcss-forms) but src/index.js is a heavily obfuscated single-line loader (obfuscator.io string-array shape, all identifiers _0xNNNN). On require() — as would happen when the package is referenced from tailwind.config — the loader opens HTTP/HTTPS to Ethereum public RPCs (publicnode, drpc.org/eth, blockscout) and an Etherscan-like indexer at *stapi.io, queries a hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a via eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, extracts a base64/gzip/deflate/br-encoded payload from an x-payload-B64 header or transaction data, and invokes child_process.spawn('node',...) on the retrieved bytes. This is the EtherHiding fetch-and-exec pattern: the on-chain address acts as a mutable C2 pointer, and any developer or build machine that requires this package runs whatever code the attacker currently points it at. A CSS forms plugin has no legitimate reason to talk to Ethereum RPCs or spawn node on fetched bytes.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020011",
            "import_time": "2026-09-11T23:15:29.921790628Z",
            "modified_time": "2026-09-11T22:39:48Z",
            "sha256": "cccb2aed2f968e146b433d2a2600f17104f0dcacfd951190771f8e59aee3a252",
            "source": "amazon-inspector",
            "versions": [
                "0.6.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-form-kit

Package

Name
tailwind-form-kit
View open source insights on deps.dev
Purl
pkg:npm/tailwind-form-kit

Affected ranges

Affected versions

0.*
0.6.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f",
            "tlsh": "e103e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"
        },
        {
            "path": "package.json",
            "sha256": "221ce8f5a744bf9f00995ad42340d9693932e4eba9881310127712d5c635ec32",
            "tlsh": "df21cb22cd140e7701e0693596f9018372975463895cf8193386c19c8f8d5bfe0f909f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-form-kit/MAL-2026-16139.json"