{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"901605dc8863d7b3ad4b767d27847881c70a6d9ccb96dc6f3e2a40db779bfb02","tlsh":"b103c906bac13571234b5f7b760bf4e4e02e2d9d7698048bd129bc94f961329d8e2b39"},{"path":"package.json","sha256":"5c99aaa1c44832939389b4f27a7b10aec4d559021aab7d02d031fe80ea536e6d","tlsh":"dc21cb26cd140e7701e0693696f911837297a463895cfc193396c19c8f8d6bfe0f909f"}],"package_integrity":[{"filename":"tailwind-contact-forms-0.5.12.tgz","hashes":{"sha1":"dfd4597f50aaab8541f224eea73f4adb8be386d4","sha512_sri":"sha512-RfKyVBSVuj9Z8lmXNd6W3GDsPWyHRONhWLLxnVN40JwVbsik7EUvftW8FVV938YdtpDWolC3vQqzc9zP2IDDiA=="}}]}},"package":{"ecosystem":"npm","name":"tailwind-contact-forms"},"versions":["0.5.12","0.5.1"]}],"credits":[{"contact":["inspector-research@amazon.com"],"name":"Amazon Inspector","type":"FINDER"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019640","import_time":"2026-09-04T06:53:31.795019554Z","modified_time":"2026-09-04T06:48:54Z","sha256":"0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50","source":"amazon-inspector","versions":["0.5.12"]},{"id":"IN-MAL-2026-020492","import_time":"2026-09-23T14:19:31.892811335Z","modified_time":"2026-09-23T14:10:59Z","sha256":"6d82b6065d9e3d4a4ebba479ed42deb342f72c48d2d69d297f3926c0225828aa","source":"amazon-inspector","versions":["0.5.1"]}]},"details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6d82b6065d9e3d4a4ebba479ed42deb342f72c48d2d69d297f3926c0225828aa)\nThe package's main module src/index.js begins with eval(atob(\"...\")) that decodes ~30 KB of obfuscated JavaScript before the genuine plugin code. The decoded loader imports http/https/zlib and child_process.spawn, hoists require and module onto globals (global['r'], global['m']) to escape the module sandbox, and evaluates payloads received from remote endpoints. The loader hardcodes an Ethereum sender address (assembled from fragments including '0xa322E5f3','D311D3080e','6f0121063e') and a set of RPC endpoints on public Ethereum nodes (drpc.org, publicnode.com, blockscout, ethereum-rpc) plus an Etherscan-style indexer queried with 'module=account&action=txlist&address=...&sort=desc'. It polls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount to monitor the on-chain address and retrieves payloads carried in x-payload-b64 headers, decompressed through zlib createGunzip/createInflate and executed. The loader fires on any require('tailwind-contact-forms'). The package name mimics @tailwindcss/forms and its package.json repository field points at https://github.com/tailwindlabs/tailwindcss-forms; the obfuscated loader is prepended above a verbatim copy of the legitimate @tailwindcss/forms plugin source so the package appears to work normally after infection.\n","id":"MAL-2026-15925","modified":"2026-09-23T14:22:02.283684027Z","published":"2026-09-04T06:48:54Z","references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-contact-forms/v/0.5.1"}],"schema_version":"1.7.4","summary":"Malicious code in tailwind-contact-forms (npm)"}