MAL-2026-19145: Malicious code in tailwindcss-hook-forms (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef) The package impersonates @tailwindcss/forms: name, repository (tailwindlabs/tailwindcss-forms), author (@tailwindcss), README, CHANGELOG, and HTML are copied from the legitimate plugin, with a demo link to tailwindcss-hook-forms.vercel.app. src/index.js prepends a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor via peel.constructor and immediately invokes a function compiled from a ~15KB opaque, obfuscated string literal, passing the host require into it. This fires whenever any consumer imports the package, running attacker-controlled code in the installer's Node.js process with full access to require, process, filesystem, and network. The subsequent code replicates the public API of @tailwindcss/forms as cover. The obfuscator scheme does not exist in the legitimate plugin and its only purpose is to conceal the executable body from review.
Affected Software
Event History
Frequently Asked Questions
What action triggers the malicious code?
The payload runs whenever a consumer imports tailwindcss-hook-forms. It is compiled and invoked in the importing Node.js process, with the host require object passed to it.
What access does the malicious code receive?
It runs with the permissions of the Node.js process importing the package. The supplied details state that it has access to require, process, the filesystem, and the network.
Is this package the same as the legitimate Tailwind forms plugin?
No. The package impersonates @tailwindcss/forms by copying its name-related identity details, repository reference, author, README, CHANGELOG, HTML, and public API. Its src/index.js contains an obfuscated executable payload that is not present in the legitimate plugin.
How can I determine whether my environment is affected?
Check whether your project depends on or imports the npm package tailwindcss-hook-forms. Any environment that imports it may execute the payload in that environment's Node.js process.