The npm package tailwindcss-form-components contains malicious code that executes remote JavaScript payloads with full Node.js privileges on the host. It fetches and executes attacker-controlled code over unencrypted HTTP from a hardcoded IP address. The package name is a typosquat of the legitimate Tailwind CSS ecosystem and includes dependencies linked to credential theft and host fingerprinting. Installation of this package compromises the host, risking exposure of all stored secrets and keys.