tailwindcss-form-components@1.4.0

One or more suspicious static signals were detected.

Consumer runtime invocation of exported `getPlugin()`.

Arbitrary code execution, including filesystem access, subprocess loading through dependencies, credential theft, or persistence chosen by the remote server.

Remote payload fetch followed by `new Function` execution with Node globals.

At runtime, `getPlugin()` requests a hard-coded endpoint and parses JSON. It then compiles and runs the server-controlled `data.credits` string through `new Function`, supplying `require`, `process`, `globalThis`, `Buffer`, and path context. This is a remote code-execution loader concealed in a package advertised as Tailwind form components; the remote payload can change without a package update.

The package contains a concrete server-controlled Node.js code-execution path unrelated to its stated purpose. Lack of an install hook limits automatic activation but does not remove the malicious runtime payload loader.