Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's advisory database published a malware advisory for the npm package tailwind-lines-clamps (GHSA-r79p-hc83-2mjh), flagged as CWE-506 embedded malicious code. All versions (= 0) are affected and no patched version exists, so any installation of the package is considered malicious. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine, exposing secrets, keys and credentials. The package sees roughly 286 downloads per month, so exposure is limited but real. There is no fix; remediation consists of removing the package and rotating all secrets from a clean machine, since removal alone cannot guarantee the malware is eradicated.
What to do
- Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer
- Remove tailwind-lines-clamps from all projects and lockfiles and rebuild affected environments from trusted images
- Audit machines for persistence and other malicious software left by the package; consider reimaging compromised hosts
- Check CI/CD and developer machines for the package and review logs for suspicious activity since installation
- Block the package name in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
