Malicious npm package tailwindcss-animate-bridge compromises developer machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub published advisory GHSA-4q2f-q5qq-w9cm on 2026-11-02 flagging the npm package tailwindcss-animate-bridge as malware (CWE-506, embedded malicious code). Every published version (= 0) is affected and no patched version exists, so any installation is inherently malicious. The advisory states that any computer with the package installed or running should be considered fully compromised, implying attackers gain full control and can steal secrets, keys, and credentials. No source code repository is known. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove all malicious software. There is no fix — the only remediation is removal plus full incident response.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine
- Remove the package from all projects, lockfiles, and CI caches and block its installation
- Rebuild affected machines and audit for persistence mechanisms and other malicious software
- Review logs and network traffic for signs of exfiltration or attacker access
- Audit dependency trees for other typosquatting or malicious packages
Sources
All live incidents on Threat Watch
