Which versions of tailwind-contact-forms are malicious?

The following npm versions of tailwind-contact-forms are flagged malicious: 0.5.1, 0.5.5, 0.5.9, 0.5.12. Treat any of these as compromised.

How do I remediate tailwind-contact-forms if I installed it?

tailwind-contact-forms establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed tailwind-contact-forms — how do I know if it already compromised me?

If tailwind-contact-forms was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tailwind-contact-forms part of a known attack campaign?

Yes — tailwind-contact-forms is associated with the IN-MAL-2026-019640, IN-MAL-2026-020492, IN-MAL-2026-020786, IN-MAL-2026-021079 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwind-contact-forms across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tailwind-contact-forms (4 malicious versions).

Malicious package

tailwind-contact-formsnpm

Advisory published Sep 4, 2026Updated Oct 5, 2026

tailwind-contact-forms is a confirmed malicious npm package (MAL-2026-15925) that opens a backdoor for remote access (malicious versions 0.5.1, 0.5.5, 0.5.9…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tailwind-contact-forms (npm)

MAL-2026-15925

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwind-contact-forms

What this malware does

The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at tailwindlabs/tailwindcss-forms, while the actual main entry src/index.js is a heavily obfuscated Node loader (obfuscator.io-style rotated string array _0x18ab with 303 entries, decoder _0x35ba, control-flow-object dispatch). On require(), the loader constructs an Etherscan-style indexer URL and Ethereum JSON-RPC endpoint list (eth.blockscout, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) from decoded string fragments, queries eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount and the txlist API for hardcoded attacker addresses (0xa322E5f3...9aDC2490Ef and 0x...D311D3080e...6f0121063e), and assembles a runtime code payload injected via global['_V...']/global['_t_u']/global['_t_s']/global['_H']/global['_H2']. The loader imports node:child_process.spawn to execute the retrieved payload. This is the EtherHiding pattern: the attacker updates transaction data on-chain to rotate second-stage code without republishing the package, and every consumer that loads tailwind-contact-forms in their tailwind.config.js executes whatever the attacker's on-chain transaction currently points to. A Tailwind plugin has no legitimate need for obfuscation, Ethereum RPC access, block-explorer indexers, or child_process spawning.

Malicious versions

4 flagged

0.5.10.5.50.5.90.5.12

Indicators of compromise (SHA-256)

0ec029f2c6cc211c953394dfe89a4ba0921f1a526ca2b0235672f6fdeca10c50

6d82b6065d9e3d4a4ebba479ed42deb342f72c48d2d69d297f3926c0225828aa

956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5

36808a08f61e6af080a534ddf1387767136fbd9b35257ab945fe8881f04a43e4

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for tailwind-contact-forms (4 malicious versions).
If you installed it — respond
tailwind-contact-forms establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If tailwind-contact-forms was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tailwind-contact-forms on npm has been identified as a malicious package (versions 0.5.1, 0.5.5, 0.5.9, 0.5.12 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019640IN-MAL-2026-020492IN-MAL-2026-020786IN-MAL-2026-021079

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks tailwind-contact-forms-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database