MAL-2026-17310

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-forms-kit/MAL-2026-17310.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17310
Published
2026-09-30T01:27:06Z
Modified
2026-09-30T01:45:10Z
Summary
Malicious code in tailwind-forms-kit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea)

npm package tailwind-forms-kit@0.5.1 impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' (with a leading space), the README mirrors tailwindlabs/tailwindcss-forms, and the repository field points at the legitimate tailwindlabs/tailwindcss-forms repo. The shipped src/index.js (the package's main entry) is not a Tailwind plugin. It is a single-line obfuscator.io-obfuscated loader (string array _0x18ab with 303 entries, rotate/shift IIFE, decoder _0x35ba, hex-named variables) that at require() time imports node:http, node:https, node:zlib, and spawn from node:child_process. It reassembles at runtime a hardcoded Ethereum sender address (0xa322E5f39aDC2490EfD311D3080e6f0121063e1a) and a list of public Ethereum RPC endpoints and an Etherscan-style indexer URL (publicnode.com, 1rpc.io, drpc.org, blockscout) from string-array indices, queries the indexer for that sender's transaction list ('?module=ac...on=txlist&address=...'), reconstructs a payload from the returned on-chain transaction data, and hands the reconstructed bytes to node:child_process spawn / dynamic execution via global slots (_t_u, _t_s, _H, _H2). This is the EtherHiding blockchain-hosted-C2 pattern: whoever controls the sender address controls arbitrary code executed on any host that installs or requires the package, with no version pin, no hash verification, and blockchain-data transport chosen to evade domain and URL blocklists. The Tailwind branding, copied README, and misleading repository URL are cover for the loader.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020784",
            "import_time":  "2026-09-30T01:36:51.330327282Z",
            "modified_time":  "2026-09-30T01:27:06Z",
            "sha256":  "a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea",
            "source":  "amazon-inspector",
            "versions":  [
                "0.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwind-forms-kit

Package

Name
tailwind-forms-kit
View open source insights on deps.dev
Purl
pkg:npm/tailwind-forms-kit

Affected ranges

Affected versions

0.*
0.5.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/index.js",
            "sha256":  "fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f",
            "tlsh":  "e103e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"
        },
        {
            "path":  "package.json",
            "sha256":  "784b58f91fa2f86b78b05ba9b821c9957c7235f6f93c0ae9e4f9ebbfc9b94fd9",
            "tlsh":  "2821c822cd140e7302e0293596f90583b297a463895cf81d3396c19c8f8d6bfe0f909f"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "tailwind-forms-kit-0.5.1.tgz",
            "hashes":  {
                "sha1":  "05ca49af22a2b65a8e6db502de6e79d92416785d",
                "sha512_sri":  "sha512-bNn+5PEe0Ngs0Xq0kda3levwwCehhf9/nAO65b7PZhtCKjsgh6ecXYV/U00kh53s74AB3lslH+oG0Se8D8axWQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwind-forms-kit/MAL-2026-17310.json"