tailwindcss-forms-ui

Details

**Severity:** Critical

**Affected versions:** `= 0.5.2`

## Source: amazon-inspector (6f2bdfef8937b1e6ef4979181693e00adbdfbe7521b8b240268f76beff8b3be8)
The package name typosquats @tailwindcss/forms but its main entry src/index.js is a 39 KB obfuscator.io bundle (303-entry rotating string array, hex-named identifiers, control-flow flattening) with no Tailwind/CSS functionality. On require(), the module attaches require and module to global scope, then queries Ethereum JSON-RPC endpoints (eth.publicnode.com, 1rpc.io/eth, eth-mainnet.public.blastapi.io, eth.drpc.org) and Etherscan/Blockscout txlist APIs for transactions from the hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a, decompresses the returned transaction data (gzip/deflate/brotli), and passes it to code-construction and node:child_process.spawn sinks. The hardcoded sender's on-chain transactions are a mutable, attacker-controlled payload channel (EtherHiding pattern), granting arbitrary code execution on any installer that require()s the module.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/tailwindcss-forms-ui/MAL-2026-16295.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/tailwindcss-forms-ui/MAL-2026-16295.json
- https://www.npmjs.com/package/tailwindcss-forms-ui/v/0.5.2
- https://github.com/advisories/GHSA-fc5q-m33g-rp9c

Compromised versions (1)

• = 0.5.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.