🛡️ MAL-2026-12221 — tailwind-custom-forms

Malicious code in tailwind-custom-forms (npm)

Source: amazon-inspector

The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at github.com/tailwindlabs/tailwindcss-forms and src/index.js contains a verbatim copy of that legitimate plugin. Appended after module.exports = forms; is eval(atob('<large base64 blob>')), which decodes and executes on any require('tailwind-custom-forms'). The decoded payload reconstructs the module names http, https, zlib, url, and child_process from \u escapes to hide its imports, uses child_process.spawn, and builds outbound HTTP requests with keep-alive agents to hosts resolved at runtime from Ethereum JSON-RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) keyed off the hardcoded ETH address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, calling paths /0x/cls and /0x/ls. On-chain records act as a rotating dispatcher so the operator can update C2 hosts without republishing the package. Requiring this module executes attacker-controlled code on the installer's machine.