Tailwind-themed npm malware wave: tailwindcss-form-utils, tailwindcss-contact-form, tailwind-forms-kit, tailwind-form-core — malicious packages fully compromise installers
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
On 2026-11-04 GitHub published four malware advisories for npm packages styled after Tailwind CSS form tooling: tailwindcss-form-utils (156 downloads/month), tailwindcss-contact-form, tailwind-forms-kit (218 downloads/month) and tailwind-form-core. All versions (= 0) are affected and no patched versions exist; the packages contain embedded malicious code (CWE-506) and have no known source code. GitHub's standard malware wording states any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including secrets and keys. The packages appear to be typosquat-style or faux-ecosystem malware rather than compromises of legitimate Tailwind projects. Removal of the package does not guarantee removal of the malicious software. No fixed versions are available; the only remediation is removal plus host forensics and credential rotation.
What to do
- Check lockfiles and node_modules for tailwindcss-form-utils, tailwindcss-contact-form, tailwind-forms-kit or tailwind-form-core and remove them from all projects and CI
- Treat any machine or CI runner where they were installed as fully compromised: rotate all secrets, keys, tokens and credentials from a clean machine
- Rebuild affected environments from trusted images and audit for persistence (runners, post-install scripts, startup items)
- Block the package names in npm registry proxies/internal allowlists and scan dependency trees for related lookalike packages
- Review npm install logs to determine when and where the packages ran
Sources
All live incidents on Threat Watch
