The npm package tailwind-form-templates version 0.7.4 contains malicious code that executes remote commands on the host installing the package. It masquerades as the legitimate @tailwindcss/forms package but appends an obfuscated payload that dynamically fetches commands from an attacker-controlled server, using Ethereum blockchain transactions to rotate the command-and-control endpoint. This results in a full remote code execution channel on the installer system.