MAL-2026-13923 Malicious code in tailwind-form-templates (npm)

The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an eval(atob(...)) payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's to field, fetches an XOR-encrypted command from that IP via an x-payload-b64 header, and executes the result through eval and a detached spawn('node', ['-e',...]). This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.