The npm package tailwindcss-forms-ui version 0.5.2 is a malicious typosquatting package that masquerades as @tailwindcss/forms. Instead of providing CSS functionality, it contains obfuscated code that executes arbitrary commands by fetching attacker-controlled payloads from Ethereum blockchain transactions. This allows remote code execution on any system that installs and requires the package.