Malicious npm package @utilitycraft/tailwindcss-motion-atelier compromises installers' machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub's advisory database published a malware advisory (GHSA-cv4q-j2g9-xp9h, CWE-506 Embedded Malicious Code) for the npm package @utilitycraft/tailwindcss-motion-atelier. Every published version (= 0) is malicious and there are no patched versions, so the package should be treated as fully compromised on any machine where it was installed or run. The advisory warns that installing it may have given an outside entity full control of the computer, meaning secrets and keys stored on affected machines must be rotated and removal of the package alone cannot be assumed to remove all malicious software. No common malware name, CVE, or specific victim organisations are given; the incident became public on 2026-11-02.
What to do
- Remove @utilitycraft/tailwindcss-motion-atelier from all projects and lockfiles immediately
- Treat every machine where it was installed or run as fully compromised; rebuild from clean images where possible
- Rotate all secrets, keys, tokens and credentials stored on affected machines, from a different, clean computer
- Audit logs and network activity on affected hosts for signs of attacker access or persistence
- Block the package in internal registries and CI to prevent reinstalls
Sources
All live incidents on Threat Watch
