tailwind-form-templates
This report shows the evidence for tailwind-form-templates@0.7.4. 1 of 2 known versions is blocked or flagged. See all versions.
This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13923 confirms this npm version as malicious.
Advisory
MAL-2026-13923
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-form-templates (npm)
Details
The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an `eval(atob(...))` payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's `to` field, fetches an XOR-encrypted command from that IP via an `x-payload-b64` header, and executes the result through `eval` and a detached `spawn('node', ['-e',...])`. This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.
References
Independent scan evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggedsrc/index.js#virtual:base64:round1View file
1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...
High
Child Process
Package source references child process execution.
src/index.js#virtual:base64:round1View on unpkg · L11global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.js#virtual:base64:round1View on unpkg · L1src/index.jsView file
•matchType = normalized_sha256
matchedPackage = tailwind-custom-forms@0.5.2
matchedPath = src/index.js
matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
7 High1 Medium5 Low
HighChild Processsrc/index.js#virtual:base64:round1
HighSame File Env Network Executionsrc/index.js#virtual:base64:round1
HighKnown Malware Source Similarityscripts/release-notes.js
HighKnown Malware Source Similaritysrc/index.js
HighKnown Malware Source Similarityscripts/release-channel.js
HighKnown Malware Source Fingerprint Signaturescripts/release-notes.js
HighPrevious Version Dangerous Deltasrc/index.js
MediumEnvironment Vars
LowScripts Present
LowEvalsrc/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tailwind-form-templates@0.7.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwind-form-templates@0.7.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.