Which versions of tailwindcss-hook-forms are malicious?

The following npm versions of tailwindcss-hook-forms are flagged malicious: 0.5.2. Treat any of these as compromised.

How do I remediate tailwindcss-hook-forms if I installed it?

tailwindcss-hook-forms is a typosquat — you almost certainly intended a legitimately-named package. Remove tailwindcss-hook-forms, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed tailwindcss-hook-forms — how do I know if it already compromised me?

If tailwindcss-hook-forms was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tailwindcss-hook-forms part of a known attack campaign?

Yes — tailwindcss-hook-forms is associated with the IN-MAL-2026-022601 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwindcss-hook-forms across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tailwindcss-hook-forms (version 0.5.2).

Malicious package

tailwindcss-hook-formsnpm

Advisory published Nov 11, 2026Updated Nov 11, 2026

tailwindcss-hook-forms is a confirmed malicious npm package (MAL-2026-19145) that typosquats a legitimate package to trick installs (malicious version 0.5.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tailwindcss-hook-forms (npm)

MAL-2026-19145

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwindcss-hook-forms

What this malware does

The package impersonates @tailwindcss/forms: name, repository (tailwindlabs/tailwindcss-forms), author (@tailwindcss), README, CHANGELOG, and HTML are copied from the legitimate plugin, with a demo link to tailwindcss-hook-forms.vercel.app. src/index.js prepends a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor via peel.constructor and immediately invokes a function compiled from a ~15KB opaque, obfuscated string literal, passing the host require into it. This fires whenever any consumer imports the package, running attacker-controlled code in the installer's Node.js process with full access to require, process, filesystem, and network. The subsequent code replicates the public API of @tailwindcss/forms as cover. The obfuscator scheme does not exist in the legitimate plugin and its only purpose is to conceal the executable body from review.

Malicious versions

1 flagged

0.5.2

Indicators of compromise (SHA-256)

d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for tailwindcss-hook-forms (version 0.5.2).
If you installed it — respond
tailwindcss-hook-forms is a typosquat — you almost certainly intended a legitimately-named package. Remove tailwindcss-hook-forms, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If tailwindcss-hook-forms was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tailwindcss-hook-forms on npm has been identified as a malicious package (version 0.5.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-022601

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks tailwindcss-hook-forms-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database