Malicious code in tailwindcss-contact-form (npm)

__

Source: amazon-inspector (0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b)

Package presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.