registry / tailwindcss-form / 2.0.7
tailwindcss-form@2.0.7
AI Security Review
scanned 12d ago · by lpm-firewall-aiInspected package metadata and the entrypoint behavior. The package has no install lifecycle hook, and the reviewed source reads and transforms CSS without a confirmed attack behavior.
Static reason
No blocking static signals were detected.
Trigger
Importing and invoking the Tailwind plugin during Tailwind configuration.
Impact
The observed behavior is limited to CSS generation; no malicious behavior was identified in the inspected source.
Mechanism
It parses the installed animate.css stylesheet and adds generated base styles and utilities.
AI rationale
Inspected package metadata and the entrypoint behavior. The package has no install lifecycle hook, and the reviewed source reads and transforms CSS without a confirmed attack behavior.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only lint and test scripts, with no install lifecycle hook; dependencies are CSS/PostCSS tooling.
- plugin.js constructs Tailwind base styles and utilities from options and the animation catalog.
- src/catalog.js reads the installed animate.css stylesheet and parses its keyframes and animation rules.
Evidence against
Behavioral surface
Filesystem
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
25"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@aaron205whitmore/postcss-animate-utils": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependenc
Low
Suspicious Lifecycle Evidence
package.json defines only lint and test scripts, with no install lifecycle hook; dependencies are CSS/PostCSS tooling.
package.jsonView on unpkg · L25plugin.jsView file
8function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.utilities);
});
}
keyframeTailwindPlugin.catalog = () => loadCatalog().names.slice();
keyfr
Low
Ai Review Evidence
plugin.js constructs Tailwind base styles and utilities from options and the animation catalog.
plugin.jsView on unpkg · L8src/catalog.jsView file
Findings
5 Low
LowScripts Present
LowFilesystem
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceplugin.js
LowAi Review Evidencesrc/catalog.js
Affected versions and remediation
This report applies to tailwindcss-form@2.0.7.
See all versions of tailwindcss-form for other recorded verdicts.
- Review the evidence and your use of tailwindcss-form@2.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.