registry / Remote code execution / tailwindcss-forms-style
tailwindcss-forms-style
A plugin that provides a basic reset for form styles that makes form elements easy to override with utilities.
This report shows the evidence for tailwindcss-forms-style@0.1.2. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concealed remote-code-execution loader embedded in the package's import path, with self-removal intended to hide the compromise. The lack of an npm lifecycle hook does not mitigate execution during ordinary plugin use.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Importing src/index.js, including normal Tailwind plugin loading.
Impact
Arbitrary code can run with the privileges of the process loading the package.
Mechanism
Obfuscated on-chain command discovery, remote payload execution, and self-removal.
Attack narrative
The exported styling plugin is followed by an immediately invoked Base64 loader. Its decoded code checks Ethereum transactions for a fixed sender, derives a host from transaction data, fetches a payload from that host, and either evaluates it in-process or launches it in a detached Node process. The loader then rewrites src/index.js to remove itself.
AI rationale
This is a concealed remote-code-execution loader embedded in the package's import path, with self-removal intended to hide the compromise. The lack of an npm lifecycle hook does not mitigate execution during ordinary plugin use.
Evidence
src/index.js
Network endpoints5
eth.blockscout.com/api1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The main entrypoint immediately evaluates an obfuscated Base64 payload.
- The decoded payload queries Ethereum RPC services, derives a remote host from a transaction, then fetches and executes a second-stage payload.
- After execution, the entrypoint overwrites itself to remove the injected code.
Evidence against
- package.json has no automatic npm lifecycle hook.
- The visible plugin code before the payload is a Tailwind form-style plugin.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flagged · loading sourcesrc/index.js#virtual:base64:round1View file
1global.i="A10-npm-new";global["r"]=require;if(typeof module==="object")global["m"]=module;const http=require("node:http");const https=require("node:https");const zlib=require("node...
High
Child Process
Package source references child process execution.
src/index.js#virtual:base64:round1View on unpkg · L11global.i="A10-npm-new";global["r"]=require;if(typeof module==="object")global["m"]=module;const http=require("node:http");const https=require("node:https");const zlib=require("node...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.js#virtual:base64:round1View on unpkg · L1src/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = tailwindcss-forms-style@0.1.1
matchedIdentity = npm:dGFpbHdpbmRjc3MtZm9ybXMtc3R5bGU:0.1.1
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Findings
6 High1 Medium5 Low
HighChild Processsrc/index.js#virtual:base64:round1
HighSame File Env Network Executionsrc/index.js#virtual:base64:round1
HighSemantic Analysis Limitedsrc/index.js#virtual:normalized:round2
HighPrevious Version Dangerous Deltasrc/index.js
HighAi Review Evidencesrc/index.js
HighAi Review Evidencesrc/index.js
MediumEnvironment Vars
LowScripts Present
LowEvalsrc/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tailwindcss-forms-style@0.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwindcss-forms-style@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.