Malicious Code Injection in tailwindcss-forms-styles Package
Summary
MAL-2026-17524: Malicious code in tailwindcss-forms-styles (npm). Affects tailwindcss-forms-styles versions 0.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tailwindcss-forms-styles package is an npm module designed to provide styling for forms using Tailwind CSS. It aims to enhance the user interface of web applications by offering pre-defined styles. However, this package has been found to contain malicious code that can compromise the security of applications that utilize it.
Vulnerability Detail
The vulnerability arises from the tailwindcss-forms-styles package, which mimics the legitimate @tailwindcss/forms plugin. It contains a top-level Immediately Invoked Function Expression (IIFE) that executes upon module load. This IIFE decodes a base64 string and executes the result using eval(). The decoded code queries public Ethereum RPC/Blockscout endpoints to retrieve a recent transaction from a hardcoded address, extracts two IPv4 addresses, and downloads an XOR-encoded JavaScript payload from dynamically resolved URLs. This leads to remote code execution on any system that requires the package, allowing attackers to execute arbitrary code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwindcss-forms-stylesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tailwindcss-forms-styles package and instead utilize the official @tailwindcss/forms plugin. You can install it using the following command: npm install @tailwindcss/forms. This will ensure that your application remains secure while still providing the necessary form styling features.
Conclusion
The tailwindcss-forms-styles package contains a serious vulnerability that allows for remote code execution, posing a significant risk to any application that uses it. It is crucial to uninstall this package and switch to the legitimate @tailwindcss/forms plugin to ensure the security of your application.
See every vulnerability recorded for tailwindcss-forms-styles →
FAQ
It is an npm package designed to provide styling for forms using Tailwind CSS, but it has been found to contain malicious code.
The malicious code executes upon loading the module, querying Ethereum endpoints and downloading harmful payloads that can execute arbitrary code.
You should uninstall the tailwindcss-forms-styles package immediately and replace it with the legitimate @tailwindcss/forms plugin.
Yes, Vulert can monitor your project for open-source vulnerabilities using just the package-lock.json file, providing real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
