registry / Remote code execution / tailwindcss-form

tailwindcss-form

A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.

This report shows the evidence for tailwindcss-form@0.5.1. 1 of 4 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing or requiring tailwindcss-form through its main entry point.

Impact

Arbitrary code can run in the importing user's environment and persist as a detached process.

Mechanism

Obfuscated blockchain-addressed remote code execution with self-removal.

Attack narrative

The package manifest directs imports to src/index.js. That file begins with an obfuscated loader, contacts Ethereum RPC and indexer endpoints, obtains transaction data that encodes network addresses, retrieves XOR-decoded content, passes it to eval, and launches it through a detached Node child process. It then rewrites src/index.js to remove the loader.

AI rationale

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

Evidence

src/index.js

Network endpoints4

ethereum-rpc.publicnode.cometh.drpc.org1rpc.io/ethapi.blockscout.com/api

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The main module is an obfuscated 39 KB single-line payload that runs immediately on import.
It queries Ethereum RPC services, derives network addresses from transactions, fetches encrypted content, evaluates it, and starts a detached Node process.
The payload overwrites its own source after running, concealing the injected code.
The source invokes eval on assembled data and then calls spawn with Node’s -e option.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The two release scripts only derive a release channel or read CHANGELOG.md.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

MinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 39.6 KB of source, external domains: www.w3.org

Source & flagged code

6 flagged

tailwind.config.jsView file

7}, L8: plugins: [require('./src')], L9: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tailwind.config.jsView on unpkg · L7

src/index.jsView file

1const _0x994d0=_0x35ba;(function(_0x246e12,_0x2bfbc0){const _0xfb0632=_0x35ba,_0x4a8fa0=_0x246e12();while(!![]){try{const _0x4b02eb=-parseInt(_0xfb0632(0x10f))/(0x11*0x141+-0x20ce+...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = tailwind-forms-styles@0.5.2 matchedPath = src/index.js matchedIdentity = npm:dGFpbHdpbmQtZm9ybXMtc3R5bGVz:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 92111eaa389cef72 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = tailwind-forms-styles@0.5.2 matchedPath = src/index.js matchedIdentity = npm:dGFpbHdpbmQtZm9ybXMtc3R5bGVz:0.5.2 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.jsView on unpkg

scripts/release-notes.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-forms-styles@0.5.2 matchedPath = scripts/release-notes.js matchedIdentity = npm:dGFpbHdpbmQtZm9ybXMtc3R5bGVz:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

scripts/release-channel.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-forms-styles@0.5.2 matchedPath = scripts/release-channel.js matchedIdentity = npm:dGFpbHdpbmQtZm9ybXMtc3R5bGVz:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

Source & flagged code

6 flagged · loading source

tailwind.config.jsView file

7}, L8: plugins: [require('./src')], L9: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tailwind.config.jsView on unpkg · L7

src/index.jsView file

1const _0x994d0=_0x35ba;(function(_0x246e12,_0x2bfbc0){const _0xfb0632=_0x35ba,_0x4a8fa0=_0x246e12();while(!![]){try{const _0x4b02eb=-parseInt(_0xfb0632(0x10f))/(0x11*0x141+-0x20ce+...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/index.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

6 High3 Medium3 Low

HighObfuscated Payload Loadersrc/index.js

HighObfuscated

HighKnown Malware Source Similaritysrc/index.js

HighKnown Malware Source Similarityscripts/release-notes.js

HighKnown Malware Source Similarityscripts/release-channel.js

HighKnown Malware Source Fingerprint Signaturesrc/index.js

MediumDynamic Requiretailwind.config.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to tailwindcss-form@0.5.1.

The versions list below shows the verdict for each recorded version.

Avoid installing tailwindcss-form@0.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-15 08:45:05.342Z (UTC).

Source advisory published: 2026-09-18 04:31:16.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.0.1-securitylatestUnknown—AllowUnder ReviewOct 15, 2026, 7:43 AM 0.0.0-stageClean—AllowPublishedOct 15, 2026, 7:42 AM 2.0.7Clean—AllowPublishedOct 10, 2026, 4:17 PM 0.5.1shownMaliciousRemote Code ExecutionBlockPublishedSep 16, 2026, 9:12 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code