GCVE-110-OSM-2026-12455

The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly. ENTRY src/index.js (main: src/index.js) DESTINATION - 8 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in src/index.js - Obfuscation: augmented proxied array function replacements in src/index.js - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/index.js - String Array Obfuscation in src/index.js: "['eth_blockN','_process',':443/0x/cl','olKrM','BtmBu','LUUcK','h.blocksco','http..." - Obfuscation patterns: hexVariables in src/index.js - recovered 1 ipv4, 2 urls, 8 domains, 8 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in src/index.js: "global['r']=require" - Dynamic Code Execution in scripts/release-channel.js: "exec(version)" PAYLOAD FILES src/index.js