tailwind-contact-forms@0.5.12

Analysis

tailwind-contact-forms is a combosquat of the tailwindcss-forms plugin. Its src/index.js bundles the genuine plugin code as a decoy and appends an obfuscated Ethereum drainer that executes when the module is loaded. The payload builds an Ethereum JSON-RPC client that contacts hardcoded endpoints (hxxps://1rpc[.]io/eth, hxxps://ethereum-rpc[.]publicnode[.]com, hxxps://eth-mainnet[.]public[.]blastapi[.]io, hxxps://eth[.]drpc[.]org, or the ETH_RPC_URL env var), hardcodes the attacker wallet 0xa322E5f39aDC2490EfD311D3080e6f0121063e, scans blockchain history (including the Etherscan txlist API) to derive nonce state for that address, spawns a node child process, and fakes a browser User-Agent. Installing and loading this package runs the drainer.