tailwindcss-form-kit@0.5.6: Malicious npm security report (Block)

Loading npm security reports…

tailwindcss-form-kit@0.5.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

scripts/release-notes.jsView file

•matchType = normalized_sha256 matchedPackage = tailwindcss-contact-form@0.5.1 matchedPath = scripts/release-notes.js matchedIdentity = npm:[redacted]:0.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

10let changelog = fs.readFileSync(path.resolve(__dirname, '..', 'CHANGELOG.md'), 'utf8') let match = new RegExp( `## \\[${version}\\] - (.*)\\n\\n([\\s\\S]*?)\\n(?:(?:##\\s)|(?:\\[))`, 'g' ).exec(changelog) if (match) { let [, date, notes] = match console.log(notes.trim()) } else { console.log(`Placeholder release notes for version: v${version}`) }

High

Ai Review Evidence

The release-notes utility only reads the package changelog and prints matching text.

scripts/release-notes.jsView on unpkg · L10

scripts/release-channel.jsView file

•matchType = normalized_sha256 matchedPackage = tailwindcss-contact-form@0.5.1 matchedPath = scripts/release-channel.js matchedIdentity = npm:[redacted]:0.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

10let version = process.argv[2] || process.env.npm[redacted] || require('../package.json').version let match = /\d+\.\d+\.\d+-(.*)\.\d+/g.exec(version) if (match) { console.log(match[1]) } else { console.log('latest')

High

Ai Review Evidence

The release-channel utility derives a release tag from a version string and prints it.

scripts/release-channel.jsView on unpkg · L10

package.jsonView file

20"scripts": { "dev": "concurrently \"npm run serve\" \"npm run watch\"", "serve": "live-server .", "watch": "npm run build -- -w", "build": "tailwindcss -o dist/tailwind.css", "test": "exit 0", "release-channel": "node ./scripts/release-channel.js", "release-notes": "node ./scripts/release-notes.js", "format": "prettier . --write" },

High

Suspicious Lifecycle Evidence

The manifest exposes a local source entrypoint and has no install lifecycle hook; its scripts are development and release utilities.

package.jsonView on unpkg · L20

src/index.jsView file

1const svgToDataUri=require("mini-svg-data-uri"),plugin=require("tailwindcss/plugin"),defaultTheme=require("tailwindcss/defaultTheme"),colors=require("tailwindcss/colors"),[baseFontSize,{lineHeight:baseLineHeight}]=defaultTheme.fontSize.base

High

Ai Review Evidence

The runtime entrypoint imports Tailwind and SVG helper modules to construct and export a form-styling plugin.

src/index.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

scripts/release-notes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

High

Ai Review Evidence

The release-notes utility only reads the package changelog and prints matching text.

scripts/release-notes.jsView on unpkg · L10

scripts/release-channel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

High

Ai Review Evidence

The release-channel utility derives a release tag from a version string and prints it.

scripts/release-channel.jsView on unpkg · L10

package.jsonView file

High

Suspicious Lifecycle Evidence

The manifest exposes a local source entrypoint and has no install lifecycle hook; its scripts are development and release utilities.

package.jsonView on unpkg · L20

src/index.jsView file

High

Ai Review Evidence

The runtime entrypoint imports Tailwind and SVG helper modules to construct and export a form-styling plugin.

src/index.jsView on unpkg · L1

Source & flagged code

6 flagged

scripts/release-notes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-notes.jsView on unpkg

High

Ai Review Evidence

The release-notes utility only reads the package changelog and prints matching text.

scripts/release-notes.jsView on unpkg · L10

scripts/release-channel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-channel.jsView on unpkg

High

Ai Review Evidence

The release-channel utility derives a release tag from a version string and prints it.

scripts/release-channel.jsView on unpkg · L10

package.jsonView file

High

Suspicious Lifecycle Evidence

The manifest exposes a local source entrypoint and has no install lifecycle hook; its scripts are development and release utilities.

package.jsonView on unpkg · L20

src/index.jsView file

High

Ai Review Evidence

The runtime entrypoint imports Tailwind and SVG helper modules to construct and export a form-styling plugin.

src/index.jsView on unpkg · L1

tailwindcss-form-kit@0.5.6

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code