registry / tailwindcss-contact-form / 0.5.1

tailwindcss-contact-form@0.5.1

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Importing the advertised Tailwind plugin runs an obfuscated dropper in src/index.js. That file queries public Ethereum RPC and indexer endpoints, recovers a payload from a hardcoded sender, then evals it and starts a detached hidden Node process.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer requires or plugins tailwindcss-contact-form (package main / Tailwind plugin import), including the demo tailwind.config.js require of ./src.

Impact

Remote code execution on the developer machine under the Node process, independent of npm lifecycle scripts.

Mechanism

Obfuscated Ethereum C2 dropper that evals and spawn-executes a recovered payload

Attack narrative

When a project installs this package and loads it as a Tailwind plugin, the obfuscated main file contacts public Ethereum RPC and Blockscout-style indexer endpoints, finds transactions from a hardcoded sender, reconstructs a remote payload, then evals it and starts a detached hidden Node process via node -e. That is import-time remote code execution disguised as a form-styling plugin cloned from tailwindcss-forms.

AI rationale

src/index.js is an obfuscated Ethereum-backed dropper that evals and spawn-executes recovered code on plugin import, while the README, types, and repository metadata impersonate a Tailwind forms plugin. Absence of npm install hooks does not reduce this: the published main entry is the trigger.

Evidence

package.jsonsrc/index.jsREADME.md

Network endpoints5

1rpc.io/eth

Package presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.

tailwindcss-contact-form@0.5.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code