Malicious Code Injection in tailwind-forms-kit Package
Summary
MAL-2026-17310: Malicious code in tailwind-forms-kit (npm). Affects tailwind-forms-kit versions 0.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tailwind-forms-kit package is an npm library designed to facilitate the integration of Tailwind CSS forms into web applications. It aims to provide developers with a streamlined way to implement form styling using Tailwind's utility-first approach. However, the package has been found to contain malicious code that can compromise the security of applications that utilize it.
Vulnerability Detail
The vulnerability arises from the tailwind-forms-kit package version 0.5.1, which impersonates the legitimate @tailwindcss/forms plugin. The package's name field includes a leading space, and its README is a direct copy of the official Tailwind CSS forms documentation. The main entry file, src/index.js, is not a Tailwind plugin but an obfuscated loader that executes malicious code. This code imports various Node.js modules and constructs a hardcoded Ethereum sender address, allowing the attacker to execute arbitrary code on any host that installs the package. This poses significant risks, including unauthorized access to sensitive information and potential exploitation of the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-forms-kitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tailwind-forms-kit package altogether and implement form styling manually using Tailwind CSS classes. This ensures that you are not exposed to the malicious code present in the compromised package.
Conclusion
The tailwind-forms-kit package has been identified as containing malicious code that poses significant security risks to applications. It is crucial for developers to remove this package and replace it with the legitimate alternative to safeguard their projects. Regular monitoring and updating of dependencies can help mitigate similar risks in the future.
See every vulnerability recorded for tailwind-forms-kit →
FAQ
The tailwind-forms-kit package is an npm library that helps developers integrate Tailwind CSS styles into their forms.
The malicious code obfuscates itself and executes a loader that can run arbitrary code on any host that installs the package, potentially leading to data theft or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your package-lock.json file, you can check for vulnerabilities without needing to access the code directly.
If you have installed the tailwind-forms-kit package, you should uninstall it immediately and replace it with the legitimate @tailwindcss/forms plugin.
To prevent future vulnerabilities, always verify the integrity of packages before installation, keep your dependencies updated, and use tools like Vulert to monitor for vulnerabilities in real-time.
