tailwind-contact-forms@0.5.8
A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.
This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package's main entry runs heavily obfuscated code at import time that fetches and executes remote content and launches a detached process. This is unrelated to a Tailwind forms plugin and supports a malicious verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Automatic when the package main entry point is imported.
Impact
An attacker-controlled response can execute code in the importing process and a detached child, with the importing user's privileges.
Mechanism
src/index.js evaluates a base64 payload that performs network requests, evaluates fetched content, and starts a detached Node child process.
Attack narrative
Importing the declared main entry immediately evaluates a concealed payload. Static decoding reveals that it fetches remote content, evaluates that content, and starts a detached Node process; it also performs Ethereum RPC and transaction-indexer activity unrelated to the package's stated purpose. The network hosts are concealed in the encoded payload.
AI rationale
The package's main entry runs heavily obfuscated code at import time that fetches and executes remote content and launches a detached process. This is unrelated to a Tailwind forms plugin and supports a malicious verdict.
Evidence
src/index.jspackage.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package manifest names src/index.js as its main entry point.
- src/index.js starts by immediately evaluating a large base64-encoded payload.
- Static decoding shows the payload downloads remote content, evaluates it, launches a detached Node child process, and calls its startup routine at import time.
- The decoded payload also makes Ethereum RPC and transaction-indexer requests, behavior unrelated to Tailwind contact-form styling.
Evidence against
- The package declares no install lifecycle scripts.
- The inspected mini-svg-data-uri dependency implements SVG-to-data-URI conversion.
Behavioral surface
EnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedsrc/index.jsView file
•matchType = normalized_sha256
matchedPackage = tailwindcss-contact-form@0.5.5
matchedPath = src/index.js
matchedIdentity = npm:[redacted]:0.5.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/index.jsView on unpkg1eval(atob("[redacted]...
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/index.jsView on unpkg · L1src/index.js#virtual:base64:round1View file
1global.i = 'A10-(*-*)';function _0x5c1d(){const _0x237d6a=['MYMtJ','TWgrG','42Cf3c8bCE','concat','esponse\x20id','qTnDG',';var\x20_glob','RrZIS',':443/0x/cl','eth_getTra','bgxeX','...
High
Findings
5 High2 Medium5 Low
HighObfuscated Payload Loadersrc/index.js#virtual:base64:round1
HighKnown Malware Source Similarityscripts/release-notes.js
HighKnown Malware Source Similaritysrc/index.js
HighKnown Malware Source Similarityscripts/release-channel.js
HighKnown Malware Source Fingerprint Signaturescripts/release-notes.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tailwind-contact-forms@0.5.8.
See all versions of tailwind-contact-forms for other recorded verdicts.
- Avoid installing tailwind-contact-forms@0.5.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.