# MAL-2026-13923: Malicious code in tailwind-form-templates (npm)


- **Type:** Malicious package
- **Package:** `tailwind-form-templates` (npm)
- **Published:** 12 Aug 2026

## What is MAL-2026-13923?

MAL-2026-13923 is a malicious package in tailwind-form-templates, published on 12 Aug 2026. 

### Official description

The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an `eval(atob(...))` payload that runs on require(). The decoded payload obfuscates its strings via \uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's `to` field, fetches an XOR-encrypted command from that IP via an `x-payload-b64` header, and executes the result through `eval` and a detached `spawn('node', ['-e',...])`. This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.

## What should I do about MAL-2026-13923?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13923 is a malicious package: tailwind-form-templates (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13923/ (Markdown: https://insights.sbomify.com/MAL-2026-13923/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13923

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13923/
Summaries are generated and may contain mistakes; the official description above is the record.