Malicious code in tailwind-contact-forms (npm)

The tailwind-contact-forms npm package (version 0.5.12) includes a main entry file src/index.js that combines legitimate Tailwind CSS forms plugin code with an obfuscated payload. The obfuscation uses a rotating string array and decoder functions to hide its true functionality. The decoded payload collects host environment information such as 'hostname', 'Win64; x64', and 'process.env', and makes network requests to Ethereum-related RPC and block-explorer domains (e.g., h.drpc.org, pc.io/eth, stapi.io, ut.com/api, and Etherscan-style query parameters). Because the malicious code runs immediately on require(), any project installing this package will execute the payload. The package's manifest falsely claims the repository of the legitimate Tailwind Labs forms plugin to mislead users. There is no legitimate reason for a CSS plugin to perform such reconnaissance or network activity.

Installing and importing tailwind-contact-forms version 0.5.12 results in execution of malicious code that collects environment information and communicates with external Ethereum-related infrastructure. This can lead to unauthorized data exposure and potential further compromise depending on the payload's capabilities. The package impersonates a trusted upstream to increase the likelihood of installation by developers, increasing risk of supply chain compromise.

Users should avoid installing or using the tailwind-contact-forms package, especially version 0.5.12. Remove this package from any projects where it is present. Since no patch or official fix is available, the best mitigation is to uninstall and replace it with the legitimate @tailwindcss/forms package from Tailwind Labs. Monitor package sources carefully to avoid similarly named malicious packages. Patch status is not confirmed; check vendor advisories or npm security notices for updates.