The tailwind-form package (version 0.5.12) is a malicious typosquat impersonating the legitimate @tailwindcss/forms plugin. Its main module uses an eval statement to fetch JavaScript code from a public, author-controlled URL (https://www.jsonkeeper.com/b/NFTTN) via axios and executes it. This design grants the package publisher unrestricted remote code execution on any machine that installs or requires the package, effectively compromising the host system. The package is unaffiliated with the legitimate author and is intended to deceive users into installing malicious code.

Any system that installs or runs tailwind-form version 0.5.12 is fully compromised due to remote code execution capabilities embedded in the package. Attackers can execute arbitrary code, potentially stealing secrets, keys, or other sensitive data. The compromise is severe enough that removing the package alone may not restore system integrity, and all secrets should be rotated from a trusted environment.

Remove the tailwind-form package version 0.5.12 immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised machines using a secure, uncompromised device. Avoid installing packages from untrusted or typosquatted sources. No official patch or fix exists since this is a malicious package; remediation relies on removal and secret rotation.