Malware in tailwindcss-visual-kit npm package — full machine compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub published a malware advisory (GHSA-f37w-2g4f-58r3) for the npm package tailwindcss-visual-kit on 2026-10-30. Every published version (= 0) is considered malicious and there are no patched versions, so any installation grants attackers full control of the affected machine, exposing all secrets, keys and credentials stored on it. The package sees roughly 854 downloads per month. Removal of the package does not guarantee removal of the malicious software, since the attacker may retain persistent access. Anyone who installed the package should treat the computer as fully compromised and rotate all secrets from a clean machine.
What to do
- Treat any machine with tailwindcss-visual-kit installed as fully compromised
- Rotate all secrets, keys and credentials stored on affected machines immediately, from a different clean computer
- Remove the package and rebuild/reimage affected systems, as removal may not eliminate the malware
- Audit for signs of persistence and unauthorized access
- Block the package in dependency policies and check CI/build environments for exposure
Sources
All live incidents on Threat Watch
