Which versions of tailwind-form are malicious?

The following npm versions of tailwind-form are flagged malicious: 0.5.12. Treat any of these as compromised.

How do I remediate tailwind-form if I installed it?

tailwind-form is a typosquat — you almost certainly intended a legitimately-named package. Remove tailwind-form, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed tailwind-form — how do I know if it already compromised me?

If tailwind-form was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tailwind-form part of a known attack campaign?

Yes — tailwind-form is associated with the IN-MAL-2026-005189, GHSA-2529-w5xc-r266 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwind-form across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tailwind-form (version 0.5.12).

Malicious package

tailwind-formnpm

Advisory published Jun 9, 2026Updated Jul 10, 2026

tailwind-form is a confirmed malicious npm package (MAL-2026-5487) that typosquats a legitimate package to trick installs (malicious version 0.5.12). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tailwind-form (npm)

MAL-2026-5487

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwind-form

What this malware does

tailwind-form is a typosquat of the legitimate @tailwindcss/forms plugin (README and repository field are copied from tailwindlabs/tailwindcss-forms, but the package is published under an unrelated name by an unaffiliated author). The main module src/index.js ends with an eval that fetches https://www.jsonkeeper.com/b/NFTTN via axios and eval's the returned JSON field content_o. Any project that requires this package executes whatever JavaScript is currently hosted at that public, author-mutable paste URL — giving the publisher unconditional remote code execution on every installer's machine at module-load time.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

0.5.12

Indicators of compromise (SHA-256)

37a2959fd43465328b090afd0464e0e3de0e1677ecd2068d4ef05bdfe5867b79

5c6aa10f62c9e6085e7f8f0f413b02bada30b24a2a3a4f7581d94526e1c3ed91

5176012d977e80b89ad08032581b9d17459e20be590b5de74d89a1df2e734124

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for tailwind-form (version 0.5.12).
If you installed it — respond
tailwind-form is a typosquat — you almost certainly intended a legitimately-named package. Remove tailwind-form, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If tailwind-form was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tailwind-form on npm has been identified as a malicious package (version 0.5.12 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005189GHSA-2529-w5xc-r266

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks tailwind-form-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database