tailwindcss-form-utils

GHSA-fm65-924g-pg2g

Malicious code in tailwindcss-form-utils (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.5.1`

## Source: amazon-inspector (1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc)
The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b4f738c2719bc533615f8c2b6a5ab143ced7546b/osv/malicious/npm/tailwindcss-form-utils/MAL-2026-16263.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b4f738c2719bc533615f8c2b6a5ab143ced7546b/osv/malicious/npm/tailwindcss-form-utils/MAL-2026-16263.json
- https://www.npmjs.com/package/tailwindcss-form-utils/v/0.5.1
- https://github.com/advisories/GHSA-fm65-924g-pg2g

Compromised versions (1)

= 0.5.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.