---
id: "MAL-2026-15925"
page: "https://infrastack.ai/live/MAL-2026-15925"
kind: "package"
aliases: ["MAL-2026-15925"]
title: "Malicious code in tailwind-contact-forms (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "tailwind-contact-forms", "fixed": [], "affected": "= 0.5.12; = 0.5.1; = 0.5.5; = 0.5.9; = 0.5.8", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-04T06:48:54+00:00"
first_seen_at: "2026-11-11T21:29:24+00:00"
updated_at: "2026-11-11T21:30:27+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-15925", "first_seen_at": "2026-11-11T21:29:24+00:00"}]
exploit_sources: []
---

# Malicious code in tailwind-contact-forms (npm)

Link for people: https://infrastack.ai/live/MAL-2026-15925 (this .md is for agents)

## Affected

- npm:tailwind-contact-forms affected = 0.5.12; = 0.5.1; = 0.5.5; = 0.5.9; = 0.5.8 fixed no fixed version listed

## Timeline

- 2026-11-11T21:29:24+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-15925

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5)
The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at tailwindlabs/tailwindcss-forms, while the actual main entry src/index.js is a heavily obfuscated Node loader (obfuscator.io-style rotated string array _0x18ab with 303 entries, decoder _0x35ba, control-flow-object dispatch). On require(), the loader constructs an Etherscan-style indexer URL and Ethereum JSON-RPC endpoint list (eth.blockscout, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) from decoded string fragments, queries eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount and the txlist API for hardcoded attacker addresses (0xa322E5f3...9aDC2490Ef and 0x...D311D3080e...6f0121063e), and assembles a runtime code payload injected via global['_V...']/global['_t_u']/global['_t_s']/global['_H']/global['_H2']. The loader imports node:child_process.spawn to execute the retrieved payload. This is the EtherHiding pattern: the attacker updates transaction data on-chain to rotate second-stage code without republishing the package, and every consumer that loads tailwind-contact-forms in their tailwind.config.js executes whatever the attacker's on-chain transaction currently points to. A Tailwind plugin has no legitimate need for obfuscation, Ethereum RPC access, block-explorer indexers, or child_process spawning.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_