The tailwind-form-templates npm package (version 0.7.4) is a malicious package impersonating the legitimate @tailwindcss/forms library. Its source code includes an eval(atob(...)) payload that runs on require(), which decodes obfuscated strings and dynamically requires http/https and child_process modules. Upon import, it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet address. It extracts an attacker-controlled IPv4 address from a transaction's 'to' field, fetches an XOR-encrypted command from that IP via a custom header, and executes the command using eval and a detached Node.js process. This creates a remote code execution backdoor on the host installing the package, with the command-and-control endpoint dynamically controlled via on-chain Ethereum transactions (EtherHiding pattern). The malicious code is grafted onto a legitimate library to evade detection.

This malicious package enables full remote code execution on any system that installs it, allowing attackers to execute arbitrary commands with the privileges of the installing user. The dynamic and obfuscated nature of the payload, combined with the use of Ethereum blockchain transactions to control the command-and-control server, makes detection and mitigation more difficult. This poses a critical risk to the confidentiality, integrity, and availability of affected systems.

No official patch or remediation is currently available. Users should avoid installing the tailwind-form-templates package version 0.7.4 and verify the authenticity of npm packages before installation. Remove any instances of this package from systems and conduct a thorough investigation for potential compromise. Monitor for suspicious network activity related to Ethereum RPC queries or unexpected outbound connections. Check vendor advisories or npm security notices for updates or official guidance.