MAL-2026-16263

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form-utils/MAL-2026-16263.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16263
Published
2026-09-17T19:51:00Z
Modified
2026-09-17T20:30:05Z
Summary
Malicious code in tailwindcss-form-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc)

The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020138",
            "import_time":  "2026-09-17T20:18:44.91394229Z",
            "modified_time":  "2026-09-17T19:51:00Z",
            "sha256":  "1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc",
            "source":  "amazon-inspector",
            "versions":  [
                "0.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwindcss-form-utils

Package

Name
tailwindcss-form-utils
View open source insights on deps.dev
Purl
pkg:npm/tailwindcss-form-utils

Affected ranges

Affected versions

0.*
0.5.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/index.js",
            "sha256":  "f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d",
            "tlsh":  "9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"
        },
        {
            "path":  "package.json",
            "sha256":  "a7e0299ab34247362af50b02bcc93061d0432320fe4d066262aaeb88c1281ec2",
            "tlsh":  "bc21a622cd140e7302e0293596f905877297a463895cf81a3396c19c8f8d6bfe0fa09f"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "tailwindcss-form-utils-0.5.1.tgz",
            "hashes":  {
                "sha1":  "77fb1c5ff05695a67340d629307ad65ccff6980f",
                "sha512_sri":  "sha512-Eg4EVI9O/Iq0vJsFTT0Kyhv9z+PARDTyFlX+jRSESnSBNkRfETa8sH7qrZ1C7Phd4QYbVSmTi4ScF1HmF/sXIQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form-utils/MAL-2026-16263.json"