tailwindcss-form-utils
This report shows the evidence for tailwindcss-form-utils@0.5.9. 2 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 12h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-16263 confirms this npm version as malicious.
Advisory
MAL-2026-16263
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwindcss-form-utils (npm)
Details
The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning itself as a lookalike of the first-party Tailwind Labs forms plugin. Its main entrypoint src/index.js is heavily obfuscated (obfuscator.io string-array with rotation, hex identifier renaming, 303 encoded string entries) and, once decoded, imports node:http, node:https, node:zlib, node:url and node:child_process spawn. It hard-codes an Ethereum sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a and queries Ethereum RPC endpoints (1rpc.io/eth, *.publicnode.com, eth.drpc.org) plus a blockscout/etherscan-style txlist indexer to retrieve transaction payloads authored by that address, reconstructs JavaScript source from the returned data, and injects it into the global scope (global.r=require, global.m=module) before executing it via child_process spawn. The blockchain acts as a mutable, attacker-writable command channel: whichever payload the attacker's address most recently published in a transaction becomes code executed on every require of the package. A Tailwind CSS plugin has no legitimate need for child_process, HTTP fetches to Ethereum RPCs, or dynamic global code assembly.
## Source: ghsa-malware (ef25a50795d52901a8900a301ff88e8e28b926fbd868245728de2ad988bde9f3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package's main entry immediately evaluates a large base64-encoded payload whose purpose cannot be established from the inspected source. Because this concealed code runs automatically and is unrelated to the package's stated utility purpose, the package warrants warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing the package through its main entry point, src/index.js.
Impact
The hidden code can run with the importing application's privileges, but its specific effects are undetermined.
Mechanism
The entry point passes a large base64 string to atob and immediately evaluates the result; the payload's behavior could not be established from the inspected source.
AI rationale
The package's main entry immediately evaluates a large base64-encoded payload whose purpose cannot be established from the inspected source. Because this concealed code runs automatically and is unrelated to the package's stated utility purpose, the package warrants warning rather than a malicious verdict.
Evidence
src/index.js
Independent scan evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- The package's main entry is src/index.js, and that file immediately evaluates code produced by atob on a large encoded string.
- The entry-point payload is concealed at import time, unrelated to the stated Tailwind form utility purpose, and its behavior cannot be established from the inspected source.
Evidence against
- The manifest declares no install or lifecycle scripts.
- The release scripts read the changelog or print a version-derived release channel.
Behavioral surface
EnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedsrc/index.jsView file
•matchType = normalized_sha256
matchedPackage = tailwindcss-contact-form@0.5.5
matchedPath = src/index.js
matchedIdentity = npm:[redacted]:0.5.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/index.jsView on unpkg1eval(atob("[redacted]...
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/index.jsView on unpkg · L1src/index.js#virtual:base64:round1View file
1global.i = 'A10-(*-*)';function _0x5c1d(){const _0x237d6a=['MYMtJ','TWgrG','42Cf3c8bCE','concat','esponse\x20id','qTnDG',';var\x20_glob','RrZIS',':443/0x/cl','eth_getTra','bgxeX','...
High
Findings
5 High2 Medium5 Low
HighObfuscated Payload Loadersrc/index.js#virtual:base64:round1
HighKnown Malware Source Similarityscripts/release-notes.js
HighKnown Malware Source Similaritysrc/index.js
HighKnown Malware Source Similarityscripts/release-channel.js
HighKnown Malware Source Fingerprint Signaturescripts/release-notes.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tailwindcss-form-utils@0.5.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwindcss-form-utils@0.5.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.