Supply chain · npm · High

Critical Malicious npm Package: tailwind-forms-styles Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-15

A malicious npm package, 'tailwind-forms-styles', has been identified as malware. Any system that installed or ran this package should be considered fully compromised, necessitating immediate secret rotation and thorough remediation.

  • Package: npm / tailwind-forms-styles
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~15/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'tailwind-forms-styles' contains malware. Installation or execution of this package leads to a complete compromise of the host system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is injected with harmful code. When integrated into a project and executed, the malicious code gains unauthorized access and control over the system, typically exfiltrating sensitive data or establishing persistence.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull unpinned dependencies
  • Organizations with internal package mirrors that may have cached the malicious package

Conditions that increase exposure

  • Projects with unpinned dependencies that automatically update to the latest version
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) in repositories
  • Automated build systems that do not perform dependency integrity checks

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.
  • The blast radius extends to any system that directly or indirectly installed this package, including developer workstations, build servers, and potentially production environments if the package was deployed.

What to do (defensive)

Detect

  • Identify all projects and systems that have 'tailwind-forms-styles' installed as a direct or transitive dependency.
  • Review dependency trees and lockfiles for the presence of 'tailwind-forms-styles'.

Contain

  • Immediately isolate any system identified as having installed or run 'tailwind-forms-styles' from the network.
  • Block 'tailwind-forms-styles' from being downloaded or installed from package registries and internal mirrors.

Remediate

  • Consider any compromised system as fully compromised; rebuild from a trusted image if possible.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, performing this action from a different, trusted system.
  • Remove the 'tailwind-forms-styles' package from all affected projects and systems. Be aware that removal alone may not eliminate all malicious software if full control was established.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.