registry / tailwindcss-form-styles / 0.5.1
tailwindcss-form-styles@0.5.1
This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoint is limited to generating Tailwind form styles, and the required release scripts process local metadata. No malicious behavior was found.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer explicitly loads the Tailwind plugin or runs a listed development or release helper command.
Impact
No unconsented mutation, network activity, credential access, or command execution was identified.
Mechanism
The plugin registers CSS style rules; the release helpers only process local version and changelog data.
AI rationale
The inspected entrypoint is limited to generating Tailwind form styles, and the required release scripts process local metadata. No malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines development and release-note commands but no install lifecycle hook.
- The runtime entrypoint constructs a Tailwind plugin that adds form styling rules.
- The release-notes helper reads the local changelog and prints matching notes.
- The release-channel helper derives and prints a release tag from a version string.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
UrlStrings
Source & flagged code
6 flaggedscripts/release-notes.jsView file
•matchType = normalized_sha256
matchedPackage = tailwindcss-contact-form@0.5.1
matchedPath = scripts/release-notes.js
matchedIdentity = npm:[redacted]:0.5.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release-notes.jsView on unpkg7let version =
process.argv[2] || process.env.npm[redacted] || require('../package.json').version
let changelog = fs.readFileSync(path.resolve(__dirname, '..', 'CHANGELOG.md'), 'utf8')
let match = new RegExp(
`
Low
Ai Review Evidence
The release-notes helper reads the local changelog and prints matching notes.
scripts/release-notes.jsView on unpkg · L7scripts/release-channel.jsView file
•
Findings
2 High1 Medium7 Low
HighKnown Malware Source Similarityscripts/release-notes.js
HighKnown Malware Source Similarityscripts/release-channel.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/index.js
LowAi Review Evidencescripts/release-notes.js
LowAi Review Evidencescripts/release-channel.js
Affected versions and remediation
This report applies to tailwindcss-form-styles@0.5.1.
See all versions of tailwindcss-form-styles for other recorded verdicts.
- Review the evidence and your use of tailwindcss-form-styles@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.