registry / tailwind-custom-forms / 0.5.2

tailwind-custom-forms@0.5.2

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the main Tailwind plugin executes an obfuscated remote payload loader. It retrieves attacker-controlled code via blockchain-derived hosts, evaluates it, and spawns a detached Node process.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Any runtime/build that requires src/index.js, including the included Tailwind config.

Impact

Arbitrary code execution and persistence under the invoking user's privileges.

Mechanism

Obfuscated import-time remote-code loader with detached process execution.

Attack narrative

The package's main entrypoint exports the expected Tailwind plugin, then immediately decodes and evaluates hidden code. That code resolves command hosts from Ethereum transaction bytes, fetches XOR-obfuscated payloads, evaluates a payload in-process, and starts another detached Node process. This creates import-time attacker-controlled execution without a lifecycle hook.

Rationale

Direct inspection confirms concrete obfuscated remote payload retrieval, eval, and detached process execution in the main entrypoint. This is malicious regardless of the absence of install hooks.

Evidence

src/index.jspackage.jsontailwind.config.jsscripts/release-channel.jsscripts/release-notes.js

Network endpoints5

eth.blockscout.com/api1rpc.io/eth

The package impersonates @tailwindcss/forms: package.json declares the name `tailwind-custom-forms` while the repository field points at `github.com/tailwindlabs/tailwindcss-forms` and src/index.js contains a verbatim copy of that legitimate plugin. Appended after `module.exports = forms;` is `eval(atob('<large base64 blob>'))`, which decodes and executes on any `require('tailwind-custom-forms')`. The decoded payload reconstructs the module names `http`, `https`, `zlib`, `url`, and `child_process` from `\u` escapes to hide its imports, uses `child_process.spawn`, and builds outbound HTTP requests with keep-alive agents to hosts resolved at runtime from Ethereum JSON-RPC endpoints (`eth.blockscout.com/api`, `1rpc.io/eth`, `eth.drpc.org`, `ethereum-rpc.publicnode.com`, `eth-mainnet.public.blastapi.io`) keyed off the hardcoded ETH address `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a`, calling paths `/0x/cls` and `/0x/ls`. On-chain records act as a rotating dispatcher so the operator can update C2 hosts without republishing the package. Requiring this module executes attacker-controlled code on the installer's machine.

tailwind-custom-forms@0.5.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code