MAL-2026-16262 Malicious code in tailwindcss-form-ui (npm)

Package name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a fully obfuscated (obfuscator.io string-array) module that has nothing to do with Tailwind CSS. On module load it imports node:child_process (spawn), node:http/https, node:zlib and node:url, builds a list of Ethereum JSON-RPC endpoints (process.env.ETH_RPC_URL, *.publicnode.com, drpc.org, 1rpc.io/eth, blockscout) and an Etherscan-style txlist URL for the hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a, and polls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount to retrieve attacker-published transactions. The retrieved payloads are decompressed via gunzip/inflate/brotli and passed to child_process.spawn, giving whoever controls that Ethereum address arbitrary command execution on any host that requires or imports the package. The on-chain command channel is takedown-resistant. The Tailwind-forms identity, the obfuscated main, and the require-time RCE together form a cover-story typosquat delivering installer-side remote code execution.