tailwindcss-form-utils@0.0.0-stage
Malicious code in tailwindcss-form-utils (npm)
Analysis
tailwindcss-form-utils@0.0.0-stage is a name-holding placeholder, not a functional package. The published tarball contains only two files — package.json and README.md, 344 bytes unpacked — with no executable code, no lifecycle hooks, no dependencies and no bin entries. package.json sets "stub": true with the description "Temporary package placeholder for staged publishing", and the README states it is a "Temporary Holding Version" whose operational replacement is awaiting a staged release. The package name has previously been used to ship malicious code; this version publishes no payload of its own and exists to reserve the name between releases. No network endpoints, dropped files, environment variables or credentials are present in this version, so the assessment is metadata-only. Consumers should not install this name.
- analyzed by
- Leitwacht
- first seen
- Oct 13, 2026, 03:04 PM
- analyzed
- Oct 13, 2026, 03:04 PM
Related advisories
- tailwindcss-form-utils@0.5.1 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.