MAL-2026-15925

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50)

tailwind-contact-forms ships src/index.js containing the legitimate @tailwindcss/forms plugin source concatenated with an obfuscator.io-style payload (rotating 328-entry string array _0x303e with decoder _0x1574, ~1300 deobfuscation transforms). The obfuscated section decodes to host-reconnaissance strings ('hostname', 'Win64; x64', 'process.env') and to network destinations targeting Ethereum RPC / block-explorer infrastructure ('h.drpc.org', 'pc.io/eth', an 'stapi.io' host, 'ut.com/api', and Etherscan-style query parameters '?module=account&action=txlist&', 'nonce', 'startbloc'). Because src/index.js is the package's main entry, the payload executes on require() in any project that installs this package. The package manifest declares repository = https://github.com/tailwindlabs/tailwindcss-forms (the real Tailwind Labs upstream, whose actual npm name is @tailwindcss/forms) while publishing under the unrelated name tailwind-contact-forms, impersonating the upstream to lure developers who mistype the real package. A CSS/Tailwind plugin has no functional reason to run obfuscated code, read host identifiers and process.env, or contact Ethereum RPC and block-explorer APIs at import time.