registry / Remote code execution / tailwindcss-form-components
tailwindcss-form-components
A module to provide an tailwindcss forms bundle.
This report shows the evidence for tailwindcss-form-components@1.5.1. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is a staged remote-code-execution loader, not a normal icon fetcher. The absence of lifecycle hooks limits automatic activation but does not remove the concrete runtime attack surface.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Runtime call to the exported getPlugin function.
Impact
Remote operator can execute arbitrary Node.js code in the consuming process.
Mechanism
Remote payload fetch followed by Function-constructor execution.
Attack narrative
index.js exposes getPlugin with defaults targeting http://31.97.137.157:45000/icons/106. It parses the response and executes data.credits through new Function while supplying require, process, globalThis, Buffer, and timers. Thus, invoking the documented package API permits the endpoint operator to run arbitrary code in the caller's Node process.
AI rationale
The package is a staged remote-code-execution loader, not a normal icon fetcher. The absence of lifecycle hooks limits automatic activation but does not remove the concrete runtime attack surface.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
31.97.137.157:45000/icons/106
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js exports getPlugin, which fetches a hard-coded IP endpoint.
- getPlugin passes server-controlled data.credits to new Function and executes it with process, require, Buffer, and globals.
- The remote payload is retried and errors are silently suppressed.
- package.json has no lifecycle hook; activation occurs when a consumer calls getPlugin.
Evidence against
- No install/preinstall/postinstall scripts are declared.
- No local credential harvesting or filesystem writes are present in the inspected source.
Behavioral surface
EvalNetwork
Source & flagged code
2 flagged · loading sourceindex.jsView file
150// Note: The code uses async/await, so we need to handle that
L151: const evalFn = new Function(
L152: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
•matchType = malicious_source_fingerprint_signature
signature = 09ff7c6144013fba
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = tailwindcss-form-components@1.5.0
matchedPath = index.js
matchedIdentity = npm:[redacted]:1.5.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgFindings
2 High1 Medium1 Low
HighEvalindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to tailwindcss-form-components@1.5.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwindcss-form-components@1.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions0.0.1-securitylatestClean—AllowPublishedAug 5, 2026, 1:10 PM1.5.1shownMaliciousRemote Code ExecutionBlockPublishedJul 22, 2026, 3:00 PM1.5.0MaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 8:50 AM1.4.1MaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 8:49 AM1.4.0MaliciousRemote Code ExecutionBlockPublishedJul 18, 2026, 3:35 AM