The tailwindcss-form-utils npm package masquerades as a legitimate Tailwind Labs plugin by copying its repository link and README. Its main entrypoint is heavily obfuscated and imports Node.js modules such as http, https, zlib, url, and child_process. It hard-codes an Ethereum address and queries multiple Ethereum RPC endpoints and blockchain explorers to retrieve transaction payloads authored by that address. These payloads are reconstructed into JavaScript source code, injected into the global scope, and executed via child_process spawn. This design allows an attacker to remotely control code execution on any system that requires this package by updating the payload on the blockchain. Such behavior is malicious and unrelated to the expected functionality of a Tailwind CSS plugin.

This package enables remote code execution on any system that installs and requires it, allowing an attacker to run arbitrary code with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, or further malware deployment. The malicious code is dynamically controlled via the Ethereum blockchain, making detection and mitigation more difficult.

No official patch or remediation is currently documented. Users should immediately remove the tailwindcss-form-utils package from their projects and replace it with the legitimate Tailwind Labs forms plugin. Avoid installing packages from untrusted sources or those that mimic popular packages. Monitor package dependencies carefully to prevent supply chain attacks.