Malware in tailwindcss-effect-lab npm package — full machine compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub's advisory database published GHSA-px86-h2q8-cjjr flagging the npm package tailwindcss-effect-lab as malware (CWE-506, embedded malicious code). Every published version (= 0) is affected and no patched version exists, so any installation is considered a compromise. Per the advisory, any computer with the package installed or running should be treated as fully compromised, with the attacker potentially holding full control and access to secrets and keys. There is no known source code repository and no fix; removal of the package does not guarantee removal of malicious software it may have deployed. All npm users who installed the package are affected.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine
- Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system
- Audit install history, CI logs and lockfiles for tailwindcss-effect-lab and block it in npm registries/proxies
- Review network logs and endpoints for signs of post-install compromise or exfiltration
Sources
All live incidents on Threat Watch
