MAL-2026-14568 Malicious code in tailwindcss-form-styles (npm)

src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style _0x string-array cipher that assigns require and module to global.r and global.m and terminates with eval(atob(<~41KB base64 blob>)). The decoded blob contains outbound HTTP client code (POST with custom Content-Type, User-Agent, gzip/deflate handling) and an EVM RPC surface targeting 1rpc.io/eth, drpc.org, and Blockscout with methods like eth_blockNumber and hardcoded contract addresses, using an on-chain dead-drop pattern to retrieve the next-stage command. A campaign tag string 'A10-npm_new2' is embedded. package.json points 'repository' at tailwindlabs/tailwindcss-forms to inherit trust from the legitimate package. The eval fires as soon as any Tailwind build loads this plugin, resulting in attacker-controlled code execution in the installer's build environment (developer machines and CI runners).

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.