Loading npm security reports…

tailwindcss-form-kit@0.5.1: Malicious npm security report (Block) | LPM Firewall

registry / tailwindcss-form-kit / 0.5.1

tailwindcss-form-kit@0.5.1

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a Tailwind form-styling plugin with explicit developer release helpers.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing the package during a Tailwind build, or explicitly running a release utility.

Impact

Applies form-control styles; no credential collection, network transmission, persistence, or destructive action was found.

Mechanism

Generates Tailwind CSS rule objects and prints local release metadata.

AI rationale

Direct inspection of the manifest, both scanner-flagged release scripts, and the runtime entry point found no lifecycle execution or malicious behavior. The similarity signal is not supported by the inspected source.

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17221

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tailwindcss-form-kit (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (db00b593e7fc0c9c362e06fce588b1fa25a695114032504a7d6c72f5141f39ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source & flagged code

6 flagged

scripts/release-notes.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-templates@0.7.2 matchedPath = scripts/release-notes.js matchedIdentity = npm:[redacted]:0.7.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

7let version = process.argv[2] || process.env.npm[redacted] || require('../package.json').version let changelog = fs.readFileSync(path.resolve(__dirname, '..', 'CHANGELOG.md'), 'utf8') let match = new RegExp( `## \\[${version}\\] - (.*)\\n\\n([\\s\\S]*?)\\n(?:(?:##\\s)|(?:\\[))`, 'g' ).exec(changelog) if (match) { let [, date, notes] = match console.log(notes.trim()) } else { console.log(`Placeholder release notes for version: v${version}`)

High

Ai Review Evidence

The flagged release-notes utility only reads CHANGELOG.md and prints a selected section.

scripts/release-notes.jsView on unpkg · L7

scripts/release-channel.jsView file

•matchType = normalized_sha256 matchedPackage = tailwind-custom-templates@0.7.2 matchedPath = scripts/release-channel.js matchedIdentity = npm:[redacted]:0.7.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

10let version = process.argv[2] || process.env.npm[redacted] || require('../package.json').version let match = /\d+\.\d+\.\d+-(.*)\.\d+/g.exec(version) if (match) { console.log(match[1]) } else { console.log('latest') }

High

Ai Review Evidence

The flagged release-channel utility only parses a version string and prints a channel.

scripts/release-channel.jsView on unpkg · L10

package.jsonView file

20"scripts": { "dev": "concurrently \"npm run serve\" \"npm run watch\"", "serve": "live-server .", "watch": "npm run build -- -w", "build": "tailwindcss -o dist/tailwind.css", "test": "exit 0", "release-channel": "node ./scripts/release-channel.js", "release-notes": "node ./scripts/release-notes.js", "format": "prettier . --write" },

High

Suspicious Lifecycle Evidence

The manifest has no preinstall, install, or postinstall hook; its release utilities require explicit npm-script invocation.

package.jsonView on unpkg · L20

src/index.jsView file

12const forms = plugin.withOptions(function (options = { strategy: undefined }) { return function ({ addBase, addComponents, theme }) { function resolveChevronColor(color, fallback) { let resolved = theme(color) if (!resolved || resolved.includes('var(')) { return fallback } return resolved.replace('<alpha-value>', '1') } const strategy = options.strategy === undefined ? ['base', 'class'] : [options.strategy] const rules = [

High

Ai Review Evidence

The runtime entry point creates Tailwind form-style rules and exports the plugin.

src/index.jsView on unpkg · L12

Source & flagged code

6 flagged · loading source

scripts/release-notes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

High

Ai Review Evidence

The flagged release-notes utility only reads CHANGELOG.md and prints a selected section.

scripts/release-notes.jsView on unpkg · L7

scripts/release-channel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

High

Ai Review Evidence

The flagged release-channel utility only parses a version string and prints a channel.

scripts/release-channel.jsView on unpkg · L10

package.jsonView file

High

Suspicious Lifecycle Evidence

The manifest has no preinstall, install, or postinstall hook; its release utilities require explicit npm-script invocation.

package.jsonView on unpkg · L20

src/index.jsView file

High

Ai Review Evidence

The runtime entry point creates Tailwind form-style rules and exports the plugin.

src/index.jsView on unpkg · L12

Source & flagged code

6 flagged

scripts/release-notes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

High

Ai Review Evidence

The flagged release-notes utility only reads CHANGELOG.md and prints a selected section.

scripts/release-notes.jsView on unpkg · L7

scripts/release-channel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

High

Ai Review Evidence

The flagged release-channel utility only parses a version string and prints a channel.

scripts/release-channel.jsView on unpkg · L10

package.jsonView file

High

Suspicious Lifecycle Evidence

The manifest has no preinstall, install, or postinstall hook; its release utilities require explicit npm-script invocation.

package.jsonView on unpkg · L20

src/index.jsView file

High

Ai Review Evidence

The runtime entry point creates Tailwind form-style rules and exports the plugin.

src/index.jsView on unpkg · L12

tailwindcss-form-kit@0.5.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code