tailwindcss-form-components@1.5.1

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Runtime call to the exported getPlugin function.

Remote operator can execute arbitrary Node.js code in the consuming process.

Remote payload fetch followed by Function-constructor execution.

index.js exposes getPlugin with defaults targeting http://31.97.137.157:45000/icons/106. It parses the response and executes data.credits through new Function while supplying require, process, globalThis, Buffer, and timers. Thus, invoking the documented package API permits the endpoint operator to run arbitrary code in the caller's Node process.

The package is a staged remote-code-execution loader, not a normal icon fetcher. The absence of lifecycle hooks limits automatic activation but does not remove the concrete runtime attack surface.