tailwind-form-kit

Details

**Severity:** Critical

**Affected versions:** `= 0.6.4`

## Source: amazon-inspector (cccb2aed2f968e146b433d2a2600f17104f0dcacfd951190771f8e59aee3a252)
[email protected] impersonates @tailwindcss/forms (package.json sets repository to https://github.com/tailwindlabs/tailwindcss-forms) but src/index.js is a heavily obfuscated single-line loader (obfuscator.io string-array shape, all identifiers _0xNNNN). On require() — as would happen when the package is referenced from tailwind.config — the loader opens HTTP/HTTPS to Ethereum public RPCs (publicnode, drpc.org/eth, blockscout) and an Etherscan-like indexer at *stapi.io, queries a hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a via eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, extracts a base64/gzip/deflate/br-encoded payload from an x-payload-B64 header or transaction data, and invokes child_process.spawn('node',...) on the retrieved bytes. This is the EtherHiding fetch-and-exec pattern: the on-chain address acts as a mutable C2 pointer, and any developer or build machine that requires this package runs whatever code the attacker currently points it at. A CSS forms plugin has no legitimate reason to talk to Ethereum RPCs or spawn node on fetched bytes.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f128a26926ba435054707f5af00821644544b030/osv/malicious/npm/tailwind-form-kit/MAL-2026-16139.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f128a26926ba435054707f5af00821644544b030/osv/malicious/npm/tailwind-form-kit/MAL-2026-16139.json
- https://www.npmjs.com/package/tailwind-form-kit/v/0.6.4
- https://github.com/advisories/GHSA-p7c5-phj5-qm49

Compromised versions (1)

• = 0.6.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.