---
id: "GHSA-cvv5-f2cc-586q"
kind: "package"
aliases: ["GHSA-cvv5-f2cc-586q", "MAL-2026-16251"]
title: "Malicious code in tailwindcss-contact-form (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "tailwindcss-contact-form", "fixed": [], "affected": "all versions", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-17T14:16:40+00:00"
first_seen_at: "2026-11-04T01:15:41+00:00"
updated_at: "2026-11-04T01:16:55+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-16251", "first_seen_at": "2026-11-04T01:15:41+00:00"}]
---

# Malicious code in tailwindcss-contact-form (npm)

## Affected

- npm:tailwindcss-contact-form affected all versions fixed ?

## Timeline

- 2026-11-04T01:15:41+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-16251

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b)
Package presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.

## Source: ghsa-malware (b0cc40255b6caf739a99426695780dbf5621d723fb1a8d2edb049fba3a30d631)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_