Malicious code in tailwind-form-templates (npm)
The npm package tailwind-form-templates contained malicious code that mimicked the legitimate @tailwindcss/forms library. The payload executed remote code execution on installation via an on-chain C2 mechanism using Ethereum transactions to rotate command endpoints.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious tailwind-form-templates package during the active distribution period.
- Ecosystems
- Attack vectors
- Affected entities
- tailwind-form-templatesMalicious npm package impersonating @tailwindcss/forms
The malicious npm package tailwind-form-templates was designed to impersonate the legitimate @tailwindcss/forms library. Its src/index.js file copied the legitimate source code but appended an obfuscated eval(atob(...)) payload that executed at require time.
The payload used sophisticated evasion techniques, including string obfuscation via Unicode escapes and dynamic imports of system modules (http, https, child_process). Upon import, it queried Ethereum public RPCs and eth.blockscout.com/api to retrieve transactions from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a).
The attacker extracted an IPv4 address from transaction data, then fetched XOR-encrypted commands from that IP via an x-payload-b64 HTTP header. Commands were executed through both eval() and detached Node.js processes, providing full remote code execution on the installer's host. The use of on-chain transactions to rotate C2 endpoints (EtherHiding pattern) made the infrastructure difficult to disrupt.
This attack combined typosquatting (similar package name), code grafting (copying legitimate source), and advanced C2 evasion to compromise developers at install time.
Indicators of compromise
- Packages
- tailwind-form-templates
Remediation
- Immediately uninstall tailwind-form-templates from all systems and projects
- Audit npm install logs and lock files to identify when the package was installed
- Assume any system that installed this package has been compromised; perform forensic analysis and credential rotation
- Use @tailwindcss/forms (the legitimate package) instead
- Review and revoke any sensitive credentials or tokens that may have been exposed on affected systems
- Monitor for suspicious outbound connections to unknown IPs, particularly those querying Ethereum RPCs or blockscout.com
- Implement npm package verification and allowlisting policies to prevent installation of typosquatted packages
Sources
- GitHub Advisory GHSA-f88v-2vrh-8v5c · GitHub Advisory Database
Cite this entry
"Malicious code in tailwind-form-templates (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-tailwind-form-templates-npm-ad60w9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package