{"answers":{"affected":"1 open source package ship an affected version, including tailwindcss-contact-form.","exploited":"There is no known exploitation of MAL-2026-16251 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16251 is a malicious package in tailwindcss-contact-form, published on 17 Sep 2026."},"fix_prompt":"MAL-2026-16251 is a malicious package: tailwindcss-contact-form (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16251/ (Markdown: https://insights.sbomify.com/MAL-2026-16251/index.md)","id":"MAL-2026-16251","markdown":"https://insights.sbomify.com/MAL-2026-16251/index.md","name":"MAL-2026-16251","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tailwindcss-contact-form (npm)","id":"MAL-2026-16251","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"tailwindcss-contact-form","purl":"pkg:npm/tailwindcss-contact-form","source":"MAL-2026-16251"}],"products":null,"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16251/"}