react-contact-forms@0.5.2

Summary

The package publishes as 'react-contact-forms' but its package.json author is '@tailwindcss' and its repository points at tailwindlabs/tailwindcss-forms. The declared main src/index.js begins with eval(atob('<~50KB base64 blob>')) and then appends the verbatim tailwindcss-forms plugin source as cover. The decoded loader imports node:http, node:https, node:zlib, node:url, and node:child_process, reconstructs strings from an array, and spawns a child node process to execute code assembled at runtime. The decoded strings include Ethereum JSON-RPC method names (eth_blockNumber, eth_getBlockByNumber, eth_getTransactionCount), RPC hosts (publicnode.com, drpc.org, blockscout.com), an Etherscan-style txlist query (module=ac...action=txlist...address=...startblock=0&endblock=99999999&sort=desc), and hardcoded hex addresses (0x1eEf0849..., EDa15d87f6..., 4e51C73C84...) — the EtherHiding pattern where the next-stage payload is retrieved from attacker-controlled blockchain state and executed on the installer. The loader fires on every require()/import of the package, so any consumer that installs this package and loads it runs attacker-controlled code in their build or app runtime. The brand impersonation of @tailwindcss and the appended genuine tailwindcss-forms code are concealment for the prepended loader.

Source: amazon-inspector (c9d186bd6a8ec4a6482a8e951bac94904fef98f09e8a8fff714dd4526ba93557)