registry / tailwindcss-form / 0.5.1

tailwindcss-form@0.5.1

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Importing the package executes a concealed remote payload loader. It contacts blockchain RPC services to locate a command source, then evaluates and detaches the retrieved code.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing or requiring tailwindcss-form through its main entry point.

Impact

Arbitrary code can run in the importing user's environment and persist as a detached process.

Mechanism

Obfuscated blockchain-addressed remote code execution with self-removal.

Attack narrative

The package manifest directs imports to src/index.js. That file begins with an obfuscated loader, contacts Ethereum RPC and indexer endpoints, obtains transaction data that encodes network addresses, retrieves XOR-decoded content, passes it to eval, and launches it through a detached Node child process. It then rewrites src/index.js to remove the loader.

AI rationale

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

Evidence

src/index.js

Network endpoints4

ethereum-rpc.publicnode.cometh.drpc.org1rpc.io/ethapi.blockscout.com/api

OSV advisory

Package name mimics the legitimate tailwindcss-forms plugin (repo field points at tailwindlabs/tailwindcss-forms) but the main entry src/index.js is an obfuscator.io-packed bundle (303-entry rotated string array, control-flow flattening) whose top-level code has no relation to a Tailwind CSS plugin. On require() it loads node:http, node:https, node:zlib, and node:child_process, then issues requests to a set of hardcoded Ethereum endpoints (eth.blockscout.com, *.publicnode.com, *.drpc.org, 1rpc.io/eth) and an INDEXER_URL, carrying an etherscan-style txlist query against a hardcoded wallet address 0xa322E5f3... and custom x-payload-* headers. Response content is stashed into process globals (_t_u, _t_s, _H, _H2) that are then consumed by a child_process.spawn call, giving the operator of the indexer remote code execution on the installer's machine at import time. The combination of typosquatted name, obfuscator.io packing of the main entry, hardcoded remote endpoints acting as a command channel, and spawn of a fetched payload is a supply-chain trojan disguised as a Tailwind plugin.

tailwindcss-form@0.5.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code