registry / Remote code execution / tailwind-contact-forms

tailwind-contact-forms

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

This report shows the evidence for tailwind-contact-forms@0.5.8. 5 of 6 known versions are blocked or flagged. See all versions.

This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The package's main entry runs heavily obfuscated code at import time that fetches and executes remote content and launches a detached process. This is unrelated to a Tailwind forms plugin and supports a malicious verdict.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Automatic when the package main entry point is imported.

Impact

An attacker-controlled response can execute code in the importing process and a detached child, with the importing user's privileges.

Mechanism

src/index.js evaluates a base64 payload that performs network requests, evaluates fetched content, and starts a detached Node child process.

Attack narrative

Importing the declared main entry immediately evaluates a concealed payload. Static decoding reveals that it fetches remote content, evaluates that content, and starts a detached Node process; it also performs Ethereum RPC and transaction-indexer activity unrelated to the package's stated purpose. The network hosts are concealed in the encoded payload.

AI rationale

Evidence

src/index.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package manifest names src/index.js as its main entry point.
src/index.js starts by immediately evaluating a large base64-encoded payload.
Static decoding shows the payload downloads remote content, evaluates it, launches a detached Node child process, and calls its startup routine at import time.
The decoded payload also makes Ethereum RPC and transaction-indexer requests, behavior unrelated to Tailwind contact-form styling.

Evidence against

The package declares no install lifecycle scripts.
The inspected mini-svg-data-uri dependency implements SVG-to-data-URI conversion.

Behavioral surface

Source

EnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 59.0 KB of source, external domains: www.w3.org

Source & flagged code

6 flagged

src/index.jsView file

•matchType = normalized_sha256 matchedPackage = tailwindcss-contact-form@0.5.5 matchedPath = src/index.js matchedIdentity = npm:[redacted]:0.5.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.jsView on unpkg

1eval(atob("[redacted]...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

src/index.js#virtual:base64:round1View file

1global.i = 'A10-(*-*)';function _0x5c1d(){const _0x237d6a=['MYMtJ','TWgrG','42Cf3c8bCE','concat','esponse\x20id','qTnDG',';var\x20_glob','RrZIS',':443/0x/cl','eth_getTra','bgxeX','...

High

Findings

5 High2 Medium5 Low

HighObfuscated Payload Loadersrc/index.js#virtual:base64:round1

HighKnown Malware Source Similarityscripts/release-notes.js

HighKnown Malware Source Similaritysrc/index.js

HighKnown Malware Source Similarityscripts/release-channel.js

HighKnown Malware Source Fingerprint Signaturescripts/release-notes.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to tailwind-contact-forms@0.5.8.

The versions list below shows the verdict for each recorded version.

Avoid installing tailwind-contact-forms@0.5.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-03 23:00:35.870Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

0.5.8latestshownMaliciousRemote Code ExecutionBlockPublishedNov 3, 2026, 9:34 PM 0.0.0-stageClean—AllowPublishedNov 3, 2026, 9:33 PM 0.5.9MaliciousMalwareBlockPublishedOct 5, 2026, 1:20 PM 0.5.5MaliciousMalwareBlockPublishedSep 28, 2026, 1:05 PM

registry / Remote code execution / tailwind-contact-forms

tailwind-contact-forms

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

This report shows the evidence for tailwind-contact-forms@0.5.8. 5 of 6 known versions are blocked or flagged. See all versions.

This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Static reason

Trigger

Automatic when the package main entry point is imported.

Impact

An attacker-controlled response can execute code in the importing process and a detached child, with the importing user's privileges.

Mechanism

src/index.js evaluates a base64 payload that performs network requests, evaluates fetched content, and starts a detached Node child process.

Attack narrative

AI rationale

Evidence

src/index.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package manifest names src/index.js as its main entry point.
src/index.js starts by immediately evaluating a large base64-encoded payload.
Static decoding shows the payload downloads remote content, evaluates it, launches a detached Node child process, and calls its startup routine at import time.
The decoded payload also makes Ethereum RPC and transaction-indexer requests, behavior unrelated to Tailwind contact-form styling.

Evidence against

The package declares no install lifecycle scripts.
The inspected mini-svg-data-uri dependency implements SVG-to-data-URI conversion.

Behavioral surface

Source

EnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 59.0 KB of source, external domains: www.w3.org

Source & flagged code

6 flagged

src/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.jsView on unpkg

1eval(atob("[redacted]...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

src/index.js#virtual:base64:round1View file

1global.i = 'A10-(*-*)';function _0x5c1d(){const _0x237d6a=['MYMtJ','TWgrG','42Cf3c8bCE','concat','esponse\x20id','qTnDG',';var\x20_glob','RrZIS',':443/0x/cl','eth_getTra','bgxeX','...

High

Findings

5 High2 Medium5 Low

HighObfuscated Payload Loadersrc/index.js#virtual:base64:round1

HighKnown Malware Source Similarityscripts/release-notes.js

HighKnown Malware Source Similaritysrc/index.js

HighKnown Malware Source Similarityscripts/release-channel.js

HighKnown Malware Source Fingerprint Signaturescripts/release-notes.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to tailwind-contact-forms@0.5.8.

The versions list below shows the verdict for each recorded version.

Avoid installing tailwind-contact-forms@0.5.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-03 23:00:35.870Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages