# MAL-2026-16263: Malicious code in tailwindcss-form-utils (npm)


- **Type:** Malicious package
- **Package:** `tailwindcss-form-utils` (npm)
- **Published:** 17 Sep 2026

## What is MAL-2026-16263?

MAL-2026-16263 is a malicious package in tailwindcss-form-utils, published on 17 Sep 2026. 

### Official description

The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly.

## What should I do about MAL-2026-16263?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16263 is a malicious package: tailwindcss-form-utils (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16263/ (Markdown: https://insights.sbomify.com/MAL-2026-16263/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16263

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16263/
Summaries are generated and may contain mistakes; the official description above is the record.