Which versions of tailwind-custom-templates are malicious?

The following npm versions of tailwind-custom-templates are flagged malicious: 0.7.2. Treat any of these as compromised.

How do I remediate tailwind-custom-templates if I installed it?

tailwind-custom-templates is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed tailwind-custom-templates — how do I know if it already compromised me?

If tailwind-custom-templates was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tailwind-custom-templates part of a known attack campaign?

Yes — tailwind-custom-templates is associated with the IN-MAL-2026-018276 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwind-custom-templates across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tailwind-custom-templates (version 0.7.2).

Malicious package

tailwind-custom-templatesnpm

tailwind-custom-templates is a confirmed malicious npm package (MAL-2026-14195) that steals credentials and exfiltrates sensitive data (malicious version 0.7.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tailwind-custom-templates (npm)

MAL-2026-14195

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwind-custom-templates

What this malware does

The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an obfuscator.io-generated payload (rotated 303-entry string array, inline decoder wrappers) that decodes to Ethereum-related network activity. The payload contains hardcoded references to an Ethereum RPC provider (drpc.org), an Etherscan-style API (query string '?module=ac'), additional remote hosts, HTTP request assembly primitives (headers, Content-Length, JSON.stringify, User-Agent 'like Gecko'), and a hardcoded ETH address (0xa322E5f3...). src/index.js is the package's main entry, so this code runs on require/import. The declared purpose (Tailwind CSS form styles) has no need for Ethereum RPC or Etherscan traffic, and the package name 'tailwind-custom-templates' does not match the bundled tailwindcss-forms source or the referenced tailwindlabs repository, indicating masquerade. The combination of a hardcoded ETH address with on-chain RPC/explorer endpoints is consistent with a wallet-address-swap/clipper or on-chain C2 that runs on the installer's machine at import time.

Malicious versions

1 flagged

0.7.2

Indicators of compromise (SHA-256)

d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for tailwind-custom-templates (version 0.7.2).
If you installed it — respond
tailwind-custom-templates is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If tailwind-custom-templates was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tailwind-custom-templates on npm has been identified as a malicious package (version 0.7.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-018276

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks tailwind-custom-templates-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database