---
id: "GHSA-p9jh-6rpw-jrjq"
kind: "package"
aliases: ["GHSA-p9jh-6rpw-jrjq", "MAL-2026-16263"]
title: "Malicious code in tailwindcss-form-utils (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "tailwindcss-form-utils", "fixed": [], "affected": "all versions", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-17T19:51:00+00:00"
first_seen_at: "2026-11-04T01:15:42+00:00"
updated_at: "2026-11-04T01:16:55+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-16263", "first_seen_at": "2026-11-04T01:15:42+00:00"}]
---

# Malicious code in tailwindcss-form-utils (npm)

## Affected

- npm:tailwindcss-form-utils affected all versions fixed ?

## Timeline

- 2026-11-04T01:15:42+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-16263

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc)
The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly.

## Source: ghsa-malware (ef25a50795d52901a8900a301ff88e8e28b926fbd868245728de2ad988bde9f3)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_