{"answers":{"affected":"1 open source package ship an affected version, including tailwindcss-form.","exploited":"There is no known exploitation of MAL-2026-16282 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16282 is a malicious package in tailwindcss-form, published on 18 Sep 2026."},"fix_prompt":"MAL-2026-16282 is a malicious package: tailwindcss-form (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16282/ (Markdown: https://insights.sbomify.com/MAL-2026-16282/index.md)","id":"MAL-2026-16282","markdown":"https://insights.sbomify.com/MAL-2026-16282/index.md","name":"MAL-2026-16282","record":{"aliases":["GHSA-c8m9-qwg6-5cv9"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name mimics the legitimate tailwindcss-forms plugin (repo field points at tailwindlabs/tailwindcss-forms) but the main entry src/index.js is an obfuscator.io-packed bundle (303-entry rotated string array, control-flow flattening) whose top-level code has no relation to a Tailwind CSS plugin. On require() it loads node:http, node:https, node:zlib, and node:child_process, then issues requests to a set of hardcoded Ethereum endpoints (eth.blockscout.com, *.publicnode.com, *.drpc.org, 1rpc.io/eth) and an INDEXER_URL, carrying an etherscan-style txlist query against a hardcoded wallet address 0xa322E5f3... and custom x-payload-* headers. Response content is stashed into process globals (_t_u, _t_s, _H, _H2) that are then consumed by a child_process.spawn call, giving the operator of the indexer remote code execution on the installer's machine at import time. The combination of typosquatted name, obfuscator.io packing of the main entry, hardcoded remote endpoints acting as a command channel, and spawn of a fetched payload is a supply-chain trojan disguised as a Tailwind plugin.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tailwindcss-form (npm)","id":"MAL-2026-16282","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"tailwindcss-form","purl":"pkg:npm/tailwindcss-form","source":"MAL-2026-16282"}],"products":null,"published":"2026-09-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16282/"}