Which versions of tailwind-form are malicious?

The following npm versions of tailwind-form are flagged malicious: 0.5.12. Treat any of these as compromised.

How do I remediate tailwind-form if I installed it?

tailwind-form is a typosquat — you almost certainly intended a legitimately-named package. Remove tailwind-form, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed tailwind-form — how do I know if it already compromised me?

If tailwind-form was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is tailwind-form part of a known attack campaign?

Yes — tailwind-form is associated with the IN-MAL-2026-005189, GHSA-2529-w5xc-r266 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwind-form across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for tailwind-form (version 0.5.12). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging tailwind-form across your stack and pipelines.

Malicious package

tailwind-formnpm

Malicious code in tailwind-form (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5487

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwind-form

What this malware does

tailwind-form is a typosquat of the legitimate @tailwindcss/forms plugin (README and repository field are copied from tailwindlabs/tailwindcss-forms, but the package is published under an unrelated name by an unaffiliated author). The main module src/index.js ends with an eval that fetches https://www.jsonkeeper.com/b/NFTTN via axios and eval's the returned JSON field content_o. Any project that requires this package executes whatever JavaScript is currently hosted at that public, author-mutable paste URL — giving the publisher unconditional remote code execution on every installer's machine at module-load time.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

0.5.12

Indicators of compromise (SHA-256)

37a2959fd43465328b090afd0464e0e3de0e1677ecd2068d4ef05bdfe5867b79

5c6aa10f62c9e6085e7f8f0f413b02bada30b24a2a3a4f7581d94526e1c3ed91

5176012d977e80b89ad08032581b9d17459e20be590b5de74d89a1df2e734124

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for tailwind-form (version 0.5.12). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging tailwind-form across your stack and pipelines.
If you installed it — respond
tailwind-form is a typosquat — you almost certainly intended a legitimately-named package. Remove tailwind-form, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If tailwind-form was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks tailwind-form before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. tailwind-form on npm has been identified as a malicious package (version 0.5.12 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005189GHSA-2529-w5xc-r266

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks tailwind-form-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring