Malicious code in tailwindcss-form-styles (npm)

The malicious tailwindcss-form-styles package (version 0.5.15) re-exports the legitimate tailwindcss-forms plugin as a cover, then appends obfuscated code that assigns require and module to global variables and executes a large base64-decoded payload. This payload includes HTTP client functionality that communicates with Ethereum RPC endpoints using hardcoded contract addresses and an on-chain dead-drop pattern to fetch next-stage commands. The package's repository field points to the legitimate tailwindlabs/tailwindcss-forms repository to inherit trust. The malicious code executes immediately when the plugin is loaded during a Tailwind build, resulting in attacker-controlled code execution in the build environment. The campaign tag 'A10-npm_new2' is embedded in the code. This compromises developer and CI environments, potentially exposing secrets and keys.

Any system that installs or runs this package version 0.5.15 is considered fully compromised. The attacker gains code execution in the build environment, which can lead to theft or manipulation of secrets, keys, and other sensitive data. Removal of the package alone does not guarantee remediation, as the attacker may have installed additional malware or backdoors. Secrets and keys stored on compromised machines should be rotated immediately from a secure environment.

Remove the malicious tailwindcss-form-styles package version 0.5.15 immediately. Rotate all secrets and keys that were stored or used on any compromised machine from a different, trusted environment. Because the attacker may have established persistent access, consider rebuilding or thoroughly cleaning affected systems. No official patch or fix is currently available; therefore, avoid using this package version. Monitor for any suspicious activity related to this compromise.