Supply chain · npm · High

Critical Malicious npm Package: `tailwindcss-contact-form` Disguised as Forms Plugin

Threat Engine Auto-Feed · data current as of 2026-09-17

The npm package `tailwindcss-contact-form` version 0.5.1 contains highly obfuscated malicious code. It masquerades as a legitimate Tailwind CSS forms plugin but is designed to execute remote code by fetching payloads from the Ethereum blockchain. Organizations using this package are at critical risk of arbitrary code execution.

  • Package: npm / tailwindcss-contact-form
  • Affected versions: = 0.5.1
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The `tailwindcss-contact-form` npm package, specifically version 0.5.1, was identified as containing malicious code. It mimics the legitimate `@tailwindcss/forms` plugin, even copying its README and linking to the official repository to deceive developers. When imported, the package's heavily obfuscated main file establishes a connection to public Ethereum RPCs and the Blockscout txlist API to query outbound transactions from a hardcoded address. It then extracts a base64 encoded payload from transaction data and executes it using Node.js's `child_process.spawn` function.

How the attack works

This is a supply-chain attack leveraging a malicious package. The attacker publishes a package that appears benign but contains hidden, obfuscated code. When a developer integrates this package into their project, the malicious code is introduced into their build environment or runtime. In this specific case, the package acts as a remote-code-execution loader, using the Ethereum blockchain as a command-and-control channel to retrieve and execute arbitrary code on systems where it is installed and imported.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with projects that directly or indirectly depend on `tailwindcss-contact-form`
  • CI/CD pipelines that pull package dependencies, especially if unpinned or using latest versions

Conditions that increase exposure

  • Projects that have `tailwindcss-contact-form` version 0.5.1 listed as a dependency
  • Build systems that do not use strict dependency pinning or lockfiles, potentially pulling in the malicious version
  • Internal package mirrors that have synchronized the malicious version
  • Developers who manually installed or required the package based on its deceptive README

Blast-radius scenarios

  • If the package is installed and imported, an attacker can achieve arbitrary remote code execution on the affected system.
  • Compromised build environments, leading to potential injection of malicious code into downstream artifacts.
  • Data exfiltration or further network compromise from systems executing the malicious payload.

What to do (defensive)

Detect

  • Scan project dependencies for `tailwindcss-contact-form` version 0.5.1.
  • Review `package.json` and `package-lock.json` (or equivalent lockfiles) for the presence of the malicious package.
  • Monitor network traffic for connections to public Ethereum RPCs (e.g., eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) from build or application environments.
  • Implement software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately quarantine any systems or environments found to have installed `tailwindcss-contact-form` version 0.5.1.
  • Block network access to known command-and-control infrastructure (Ethereum RPCs) from affected environments.
  • Isolate development and build environments from production systems.

Remediate

  • Remove `tailwindcss-contact-form` version 0.5.1 from all project dependencies.
  • Clean npm caches (`npm cache clean --force`) and reinstall dependencies from a trusted source.
  • Audit all projects for direct and transitive dependencies on the malicious package.
  • Rotate credentials and API keys that may have been exposed on compromised systems.
  • Consider rebuilding affected applications and redeploying to ensure no persistent compromise.

Frontier verdict — High

Prioritize immediate detection and removal of `tailwindcss-contact-form` version 0.5.1 due to critical remote code execution risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.