mal-2026-16124
Vulnerability from ossf_malicious_packages
Published
2026-09-10 18:05
Modified
2026-09-14 16:21
Summary
Malicious code in tailwindcss-contact-forms (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30)
The package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process — a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "src/index.js",
"sha256": "96f6f69831f631dd4d054f9ef51706445b3db58ffd78f0e2090786a35dae7c37",
"tlsh": "510309017e80251627074e77b75bf0d0f10e4d8d74d848cad218bca4faa57a6e5f2b76"
},
{
"path": "package.json",
"sha256": "1fb8f187e61a11f9cf5b2b0c1bf1e537e910f1ba6f85641605797a1126e545b1",
"tlsh": "ac219426cd140e7701e0693596f901837297a463895cf8193396c19c8f8d6bfa0fa09f"
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "tailwindcss-contact-forms"
},
"versions": [
"0.5.8",
"0.5.6",
"0.5.5",
"0.5.4",
"0.5.9",
"0.6.0",
"0.5.7",
"0.6.1",
"0.6.2"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-019927",
"import_time": "2026-09-10T18:20:41.88591018Z",
"modified_time": "2026-09-10T18:05:28Z",
"sha256": "297b6067187ab46efa382926811e477c44ba6cc43ec73857cd82a029dbd4f143",
"source": "amazon-inspector",
"versions": [
"0.5.8"
]
},
{
"id": "IN-MAL-2026-019928",
"import_time": "2026-09-10T18:20:41.937972455Z",
"modified_time": "2026-09-10T18:05:38Z",
"sha256": "de214bf61202227c4cb55d5d694a713db6b5d1be37d8ab405490e83b30a4cc66",
"source": "amazon-inspector",
"versions": [
"0.5.6"
]
},
{
"id": "IN-MAL-2026-019925",
"import_time": "2026-09-10T18:20:41.81874445Z",
"modified_time": "2026-09-10T18:05:11Z",
"sha256": "43fbb7bac749e4d8b427e71a65cb023073da42bce730bc4d14b7c790bc1ee825",
"source": "amazon-inspector",
"versions": [
"0.5.5"
]
},
{
"id": "IN-MAL-2026-019929",
"import_time": "2026-09-10T18:20:41.96802671Z",
"modified_time": "2026-09-10T18:05:47Z",
"sha256": "4f67d5140640ce71a71be6d18d85c5069df64a926a2e9e5a41380c94039242c9",
"source": "amazon-inspector",
"versions": [
"0.5.4"
]
},
{
"id": "IN-MAL-2026-019931",
"import_time": "2026-09-10T18:20:42.072448518Z",
"modified_time": "2026-09-10T18:06:02Z",
"sha256": "89b3c4a5af676eb6eaddab75e26223a6740de56199e769148a0b5c1ed3d25c36",
"source": "amazon-inspector",
"versions": [
"0.5.9"
]
},
{
"id": "IN-MAL-2026-019935",
"import_time": "2026-09-10T18:20:42.298193533Z",
"modified_time": "2026-09-10T18:06:38Z",
"sha256": "cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30",
"source": "amazon-inspector",
"versions": [
"0.6.0"
]
},
{
"id": "IN-MAL-2026-019926",
"import_time": "2026-09-10T18:20:41.854715421Z",
"modified_time": "2026-09-10T18:05:22Z",
"sha256": "d0afcb1e0184276d3bfa609dccad2c2d417f065ad8cb3db832cca14ce27d9239",
"source": "amazon-inspector",
"versions": [
"0.5.7"
]
},
{
"id": "IN-MAL-2026-020009",
"import_time": "2026-09-11T23:15:29.548461231Z",
"modified_time": "2026-09-11T22:37:36Z",
"sha256": "56b5020fd066a5f1fea72f976fbfc0fc88907571c54d58596d389a8ead01c20c",
"source": "amazon-inspector",
"versions": [
"0.6.1"
]
},
{
"id": "IN-MAL-2026-020018",
"import_time": "2026-09-14T16:19:11.936205693Z",
"modified_time": "2026-09-14T15:41:48Z",
"sha256": "aac7c18e5852ce379f645560021e1699f1201f666e80a0d0011145ed445103ca",
"source": "amazon-inspector",
"versions": [
"0.6.2"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30)\nThe package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process \u2014 a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.\n",
"id": "MAL-2026-16124",
"modified": "2026-09-14T16:21:07.928940644Z",
"published": "2026-09-10T18:05:11Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.8"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.6"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.4"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.9"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.6.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.5.7"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.6.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tailwindcss-contact-forms/v/0.6.2"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in tailwindcss-contact-forms (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…