tailwind-forms-kit

Details

**Severity:** Critical

**Affected versions:** `= 0.5.1`

## Source: amazon-inspector (a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea)
npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' (with a leading space), the README mirrors tailwindlabs/tailwindcss-forms, and the repository field points at the legitimate tailwindlabs/tailwindcss-forms repo. The shipped src/index.js (the package's main entry) is not a Tailwind plugin. It is a single-line obfuscator.io-obfuscated loader (string array _0x18ab with 303 entries, rotate/shift IIFE, decoder _0x35ba, hex-named variables) that at require() time imports node:http, node:https, node:zlib, and spawn from node:child_process. It reassembles at runtime a hardcoded Ethereum sender address (0xa322E5f39aDC2490EfD311D3080e6f0121063e1a) and a list of public Ethereum RPC endpoints and an Etherscan-style indexer URL (publicnode.com, 1rpc.io, drpc.org, blockscout) from string-array indices, queries the indexer for that sender's transaction list ('?module=ac...on=txlist&address=...'), reconstructs a payload from the returned on-chain transaction data, and hands the reconstructed bytes to node:child_process spawn / dynamic execution via global slots (_t_u, _t_s, _H, _H2). This is the EtherHiding blockchain-hosted-C2 pattern: whoever controls the sender address controls arbitrary code executed on any host that installs or requires the package, with no version pin, no hash verification, and blockchain-data transport chosen to evade domain and URL blocklists. The Tailwind branding, copied README, and misleading repository URL are cover for the loader.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9b3ccbf4bfc4af3c2e53e9b0729d217beb12d481/osv/malicious/npm/tailwind-forms-kit/MAL-2026-17310.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/9b3ccbf4bfc4af3c2e53e9b0729d217beb12d481/osv/malicious/npm/tailwind-forms-kit/MAL-2026-17310.json
- https://www.npmjs.com/package/tailwind-forms-kit/v/0.5.1
- https://github.com/ossf/malicious-packages/blob/0b12573c4619a0868af801f8381d0628db5d4834/osv/malicious/npm/tailwind-forms-kit/MAL-2026-17310.json
- https://www.npmjs.com/package/tailwind-forms-kit/v/0.5.3
- https://github.com/advisories/GHSA-w873-w35f-2523

Compromised versions (1)

• = 0.5.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.