VulnerabilityPublished 10 Sep 2026Updated 11 Sep 2026

tailwindcss-contact-forms (npm) · Malicious Code

Affects tailwindcss-contact-formsSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 14 Sep 2026, 00:46 UTC

What to do

Affected software

Product	Affected	Fixed in
npmtailwindcss-contact-forms	Affected =0.5.8 =0.5.6 =0.5.5 =0.5.4 =0.5.9 =0.6.0 =0.5.7 =0.6.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Users should immediately remove the tailwindcss-contact-forms package from their projects and avoid installing it. Verify dependencies to ensure no transitive inclusion of this package. Consider auditing package sources and using trusted package registries. Monitor for any unusual network activity related to Ethereum RPC endpoints or unknown external endpoints.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30) The package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process — a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.

Impact

This malicious package can execute arbitrary code on the developer's environment when required, potentially leading to unauthorized command execution, data exfiltration, and further compromise of development or build systems. The use of Ethereum blockchain queries for command-and-control signaling suggests a stealthy and dynamic control mechanism. The presence of obfuscated code and external communications increases the risk of undetected malicious activity.

Summary

The tailwindcss-contact-forms npm package falsely presents itself as a Tailwind CSS forms plugin by copying README and documentation from the legitimate @tailwindcss/forms package. However, its main module is heavily obfuscated and executes top-level code on require() that installs Node.js primitives for arbitrary code execution, including importing 'child_process.spawn'. It enumerates public Ethereum JSON-RPC endpoints and queries blockchain data for a hardcoded Ethereum address, using the returned data as command-and-control signals. The package then sends collected results to an external endpoint via HTTP POST with custom headers. This malicious behavior is inconsistent with the expected functionality of a CSS plugin and indicates a supply chain compromise with potential for arbitrary code execution and data leakage.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Sep 2026, 22:13 UTC

Technical details

References

Community reviews