Malicious npm package tailwindcss-hook-forms impersonates @tailwindcss/forms to run obfuscated code on import
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
A malicious npm package, tailwindcss-hook-forms version 0.5.2, impersonates the legitimate @tailwindcss/forms plugin, copying its name, repository, author, README, CHANGELOG and demo links. Its src/index.js contains a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor and immediately executes a ~15KB obfuscated payload, passing the host require into it. The payload runs whenever any consumer imports the package, giving attacker-controlled code full access to require, process, filesystem and network in the Node.js process, then replicates the public API as cover. Flagged by OpenSSF and Amazon Inspector; no patched versions exist, so removal is the only remediation.
What to do
- Search lockfiles and node_modules for tailwindcss-hook-forms and remove it immediately
- Rotate any credentials, tokens or secrets accessible from affected build/CI environments
- Audit build and CI logs and hosts for signs of execution or network egress tied to the package
- Pin and verify the legitimate @tailwindcss/forms plugin and review dependency trees for lookalike packages
Sources
All live incidents on Threat Watch
