MAL-2026-16251

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-form/MAL-2026-16251.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16251
Published
2026-09-17T14:16:40Z
Modified
2026-09-17T14:30:05Z
Summary
Malicious code in tailwindcss-contact-form (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b)

Package presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020120",
            "import_time": "2026-09-17T14:20:23.161698178Z",
            "modified_time": "2026-09-17T14:16:40Z",
            "sha256": "0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b",
            "source": "amazon-inspector",
            "versions": [
                "0.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwindcss-contact-form

Package

Name
tailwindcss-contact-form
View open source insights on deps.dev
Purl
pkg:npm/tailwindcss-contact-form

Affected ranges

Affected versions

0.*
0.5.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d",
            "tlsh": "9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"
        },
        {
            "path": "package.json",
            "sha256": "b8a15fdbb763bf7f22700668956964130dcd94e6aa8c946c9c530461b29b283d",
            "tlsh": "7721a622cd180e7302e0693596f905837297a463895cf8193396c19ccf8d6bfe0f909f"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwindcss-contact-form-0.5.1.tgz",
            "hashes": {
                "sha1": "1b85b6533839b12a1f10cc8baa609d324412a433",
                "sha512_sri": "sha512-KKFOm8kF/qxxkIW8BwSvwCNmszsN2T573UvFFZT8mjgpfMY7sVg4K8O1QBkZJF+OWGeDhhtMDcyqCe35FTXx4A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-form/MAL-2026-16251.json"