MAL-2026-14195 Malicious code in tailwind-custom-templates (npm)

The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an obfuscator.io-generated payload (rotated 303-entry string array, inline decoder wrappers) that decodes to Ethereum-related network activity. The payload contains hardcoded references to an Ethereum RPC provider (drpc.org), an Etherscan-style API (query string '?module=ac'), additional remote hosts, HTTP request assembly primitives (headers, Content-Length, JSON.stringify, User-Agent 'like Gecko'), and a hardcoded ETH address (0xa322E5f3…). src/index.js is the package's main entry, so this code runs on require/import. The declared purpose (Tailwind CSS form styles) has no need for Ethereum RPC or Etherscan traffic, and the package name 'tailwind-custom-templates' does not match the bundled tailwindcss-forms source or the referenced tailwindlabs repository, indicating masquerade. The combination of a hardcoded ETH address with on-chain RPC/explorer endpoints is consistent with a wallet-address-swap/clipper or on-chain C2 that runs on the installer's machine at import time.