MAL-2026-19145

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-hook-forms/MAL-2026-19145.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19145
Published
2026-11-11T20:55:10Z
Modified
2026-11-11T21:15:16Z
Summary
Malicious code in tailwindcss-hook-forms (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef)

The package impersonates @tailwindcss/forms: name, repository (tailwindlabs/tailwindcss-forms), author (@tailwindcss), README, CHANGELOG, and HTML are copied from the legitimate plugin, with a demo link to tailwindcss-hook-forms.vercel.app. src/index.js prepends a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor via peel.constructor and immediately invokes a function compiled from a ~15KB opaque, obfuscated string literal, passing the host require into it. This fires whenever any consumer imports the package, running attacker-controlled code in the installer's Node.js process with full access to require, process, filesystem, and network. The subsequent code replicates the public API of @tailwindcss/forms as cover. The obfuscator scheme does not exist in the legitimate plugin and its only purpose is to conceal the executable body from review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022601",
            "import_time": "2026-11-11T21:05:23.027300784Z",
            "modified_time": "2026-11-11T20:55:10Z",
            "sha256": "d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef",
            "source": "amazon-inspector",
            "versions": [
                "0.5.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tailwindcss-hook-forms

Package

Name
tailwindcss-hook-forms
View open source insights on deps.dev
Purl
pkg:npm/tailwindcss-hook-forms

Affected ranges

Affected versions

0.*
0.5.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "860f4933ca8ff3d4b7b09fb1d4eab7caaf69dc5ab5f9f04193040a921ff265ae",
            "tlsh": "89b24b2b3413033bb9138c784adaa8f0760db01577b4c3e5f4ad80b05f8a5e8a576e9d"
        },
        {
            "path": "package.json",
            "sha256": "3970683d138585b1304ade506824ff3754de3432470db6f8d31025e122790f9e",
            "tlsh": "e121a526cd140e7302d0283596f90183b2979863895cbc193396c19c8f8d5bfe0fa09e"
        }
    ],
    "package_integrity": [
        {
            "filename": "tailwindcss-hook-forms-0.5.2.tgz",
            "hashes": {
                "sha1": "0ee686bb29beeea912396b45341877f03dd9fe70",
                "sha512_sri": "sha512-ZflHPkmXX3GuqTZaZMKV7WCle3GYJ/AMnX/AJ2x+NE+ZHa9L8xs8F6FeJrpFEgm/hdvLd5DMxdihZDd3TH2VCw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-hook-forms/MAL-2026-19145.json"