{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "src/index.js",
              "sha256": "fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f",
              "tlsh": "e103e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"
            },
            {
              "path": "package.json",
              "sha256": "784b58f91fa2f86b78b05ba9b821c9957c7235f6f93c0ae9e4f9ebbfc9b94fd9",
              "tlsh": "2821c822cd140e7302e0293596f90583b297a463895cf81d3396c19c8f8d6bfe0f909f"
            }
          ],
          "package_integrity": [
            {
              "filename": "tailwind-forms-kit-0.5.1.tgz",
              "hashes": {
                "sha1": "05ca49af22a2b65a8e6db502de6e79d92416785d",
                "sha512_sri": "sha512-bNn+5PEe0Ngs0Xq0kda3levwwCehhf9/nAO65b7PZhtCKjsgh6ecXYV/U00kh53s74AB3lslH+oG0Se8D8axWQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "tailwind-forms-kit"
      },
      "versions": [
        "0.5.1",
        "0.5.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020784",
        "import_time": "2026-09-30T01:36:51.330327282Z",
        "modified_time": "2026-09-30T01:27:06Z",
        "sha256": "a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea",
        "source": "amazon-inspector",
        "versions": [
          "0.5.1"
        ]
      },
      {
        "id": "IN-MAL-2026-021099",
        "import_time": "2026-10-06T20:20:38.700621273Z",
        "modified_time": "2026-10-06T19:51:16Z",
        "sha256": "0ddad6b159f2cfa136e4e3f97e86ab0b901a4fb083d1a18987f9daf48f66306e",
        "source": "amazon-inspector",
        "versions": [
          "0.5.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea)\nnpm package tailwind-forms-kit@0.5.1 impersonates the @tailwindcss/forms plugin: the package.json name field is \u0027 tailwind-forms-kit\u0027 (with a leading space), the README mirrors tailwindlabs/tailwindcss-forms, and the repository field points at the legitimate tailwindlabs/tailwindcss-forms repo. The shipped src/index.js (the package\u0027s main entry) is not a Tailwind plugin. It is a single-line obfuscator.io-obfuscated loader (string array _0x18ab with 303 entries, rotate/shift IIFE, decoder _0x35ba, hex-named variables) that at require() time imports node:http, node:https, node:zlib, and spawn from node:child_process. It reassembles at runtime a hardcoded Ethereum sender address (0xa322E5f39aDC2490EfD311D3080e6f0121063e1a) and a list of public Ethereum RPC endpoints and an Etherscan-style indexer URL (publicnode.com, 1rpc.io, drpc.org, blockscout) from string-array indices, queries the indexer for that sender\u0027s transaction list (\u0027?module=ac...on=txlist\u0026address=...\u0027), reconstructs a payload from the returned on-chain transaction data, and hands the reconstructed bytes to node:child_process spawn / dynamic execution via global slots (_t_u, _t_s, _H, _H2). This is the EtherHiding blockchain-hosted-C2 pattern: whoever controls the sender address controls arbitrary code executed on any host that installs or requires the package, with no version pin, no hash verification, and blockchain-data transport chosen to evade domain and URL blocklists. The Tailwind branding, copied README, and misleading repository URL are cover for the loader.\n",
  "id": "MAL-2026-17310",
  "modified": "2026-10-06T20:22:38.767519153Z",
  "published": "2026-09-30T01:27:06Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/tailwind-forms-kit/v/0.5.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/tailwind-forms-kit/v/0.5.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in tailwind-forms-kit (npm)"
}