The tailwindcss-form-components npm package (versions 1.4.0, 1.4.1, 1.5.0, and 1.5.1) contains malicious code in its index.js file. It exposes a getPlugin() function that performs an HTTP GET request to a hardcoded IP address (http://46.183.25.232:45000/icons/106), retrieves JSON data, and executes the 'credits' field as JavaScript code via new Function(), injecting Node.js globals such as require, module, process, and Buffer. This grants the remote server full execution privileges on the host machine. The package name is a typosquat of the Tailwind CSS ecosystem, and it declares dependencies (@primno/dpapi, better-sqlite3, node-machine-id) associated with Windows credential access, SQLite database reading, and host fingerprinting. The transport uses plain HTTP with no integrity checks, allowing the attacker to modify the payload arbitrarily. This results in full compromise of any system running this package.

Any system with this package installed or running is fully compromised, as the attacker gains remote code execution with full Node.js privileges. This allows theft of secrets, credentials, and keys stored on the host. The malicious payload can be modified at will by the attacker due to the lack of transport security. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the tailwindcss-form-components package versions 1.4.0, 1.4.1, 1.5.0, and 1.5.1 is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted machine. Due to full host compromise, assume persistent malicious presence and perform a thorough incident response and system rebuild. No official patch or fix is available; the package is malicious by design.