The tailwindcss-contact-form npm package is a malicious package masquerading as the legitimate Tailwind CSS forms plugin. It contains heavily obfuscated code that, when imported, connects to public Ethereum RPC endpoints and a blockchain explorer API to retrieve a base64-encoded payload from transactions associated with a hardcoded Ethereum address. This payload is then executed on the host system, effectively enabling remote code execution controlled via the Ethereum blockchain. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately.