The npm package tailwindcss-form-ui (version 0.5.1) is a malicious typosquatting package impersonating the legitimate tailwindcss-forms plugin. It contains fully obfuscated code that executes arbitrary commands on the host by polling Ethereum blockchain transactions for attacker-controlled payloads. This installer-side remote code execution allows attackers to run commands on any system that installs or imports the package. The attack uses a takedown-resistant on-chain command channel, making mitigation difficult without removing the package.