LWA-2026-12969 confirmed malware

tailwindcss-form-utils@0.0.0-stage

Malicious code in tailwindcss-form-utils (npm)

Analysis

tailwindcss-form-utils@0.0.0-stage is a name-holding placeholder, not a functional package. The published tarball contains only two files — package.json and README.md, 344 bytes unpacked — with no executable code, no lifecycle hooks, no dependencies and no bin entries. package.json sets "stub": true with the description "Temporary package placeholder for staged publishing", and the README states it is a "Temporary Holding Version" whose operational replacement is awaiting a staged release. The package name has previously been used to ship malicious code; this version publishes no payload of its own and exists to reserve the name between releases. No network endpoints, dropped files, environment variables or credentials are present in this version, so the assessment is metadata-only. Consumers should not install this name.

analyzed by
Leitwacht
first seen
Oct 13, 2026, 03:04 PM
analyzed
Oct 13, 2026, 03:04 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.