tailwindcss-contact-forms@0.5.8

Analysis

tailwindcss-contact-forms is a trojanized clone of the legitimate @tailwindcss/forms plugin. The package's main entry src/index.js ships the real plugin code but appends an obfuscated implant that runs when the module is loaded. The implant queries Ethereum mainnet RPC endpoints to locate a specific sender's latest on-chain transaction, decodes the transaction recipient address into a C2 host:port, then connects to that host over HTTP and fetches a payload that it XOR-decodes and base64-decodes before executing. The C2 endpoint is thus hidden inside an on-chain transaction rather than in the package itself. The implant also imports child_process spawn and maintains keep-alive HTTP/HTTPS connection pools for the C2 channel.