Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database (GHSA-8j4g-6q77-9w6p, published 2026-11-13) flags the npm package tailwindcss-hook-forms version 0.5.2 as containing embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor; secrets and keys on affected systems must be rotated. The package shows ~52 weekly npm downloads despite a claimed 4,563 GitHub stars, and no patched version exists — the package itself is malware and should be removed. Removal alone is not guaranteed to eliminate all malicious software planted during installation.
What to do
- Immediately remove tailwindcss-hook-forms@0.5.2 from all projects and lockfiles
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, from a clean computer
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit npm dependencies and CI caches for the package and block it in dependency firewalls/allowlists
- Review logs and network traffic for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
