The tailwind-form-kit package version 0.6.4 is a malicious npm package impersonating the legitimate @tailwindcss/forms. Its main script is heavily obfuscated and, when loaded, connects to multiple Ethereum public RPC endpoints and a blockchain indexer to query a hardcoded Ethereum address. It retrieves encoded payloads embedded in blockchain transaction headers or data, decodes them, and executes the resulting code via child_process.spawn('node', ...). This technique, known as EtherHiding, uses the blockchain as a mutable command-and-control channel, enabling attackers to remotely control code execution on any developer or build machine that installs this package.

Any developer or build system that installs or requires [email protected] will execute attacker-controlled code fetched dynamically from the Ethereum blockchain. This can lead to arbitrary code execution, compromise of build environments, theft of credentials, insertion of further malicious code, or other attacker actions. The malicious behavior is hidden behind obfuscation and masquerades as a legitimate CSS forms plugin, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should immediately remove [email protected] from their projects and avoid installing or requiring this package. Verify dependencies to ensure no transitive inclusion of this malicious package. Use only trusted and verified packages from official sources. Monitor for any signs of compromise in development or build environments where this package was used. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.