Malicious code in tailwind-forms-kit (npm)

The tailwind-forms-kit npm package version 0.5.1 impersonates the official Tailwind CSS forms plugin by using a similar package name (with a leading space), copying the README, and referencing the legitimate repository. Its main JavaScript file is obfuscated and, upon require(), imports Node.js core modules including http, https, zlib, and child_process. It reconstructs a hardcoded Ethereum sender address and queries multiple public Ethereum RPC endpoints and an Etherscan-style indexer to retrieve on-chain transaction data. This data is decoded into a payload that is then executed dynamically via child_process.spawn. This technique, known as EtherHiding blockchain-hosted command and control (C2), enables whoever controls the Ethereum address to run arbitrary code on any system using this package, circumventing traditional network-based blocking methods.

An attacker controlling the hardcoded Ethereum address can execute arbitrary code on any system that installs or requires the affected tailwind-forms-kit package version 0.5.1. This compromises the host's security, potentially allowing full system compromise, data theft, or further malicious activity. The use of blockchain-hosted payload delivery evades conventional domain or URL filtering, increasing the stealth and persistence of the attack.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing or using tailwind-forms-kit versions 0.5.1 and 0.5.3. Verify package authenticity by checking the exact package name (watch for leading spaces), repository URLs, and source integrity. Prefer official packages from trusted sources and consider using package integrity verification tools such as checksums or signed packages. Monitor for and remove any installations of this package from development and production environments.