npm malware wave: tailwindcss-theme-kit, noelc-css-blender, tailwind-base-buttons — malicious packages fully compromise installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-10-24
GitHub's advisory database published three malware advisories on 2026-10-24/25 covering npm packages tailwindcss-theme-kit (GHSA-v5xr-xjx7-ggwf), noelc-css-blender (GHSA-cj2x-975v-jmwf) and tailwind-base-buttons (GHSA-5j43-343m-gggg). All versions (= 0) are affected, no patched versions exist, and each is rated critical under CWE-506 (embedded malicious code). The advisories state any computer with these packages installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Removal of the package does not guarantee removal of the malicious software. No common name or CVE is assigned; no known source code is available. Any developer or CI environment that installed these packages is affected.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine that installed these packages, using a clean computer
- Remove the packages from all projects, lockfiles and CI caches, and audit for persistence mechanisms left behind
- Rebuild or wipe affected developer machines and CI runners; review logs for outbound connections or exfiltration
- Check dependency trees and lockfiles for the three package names and block them in registry proxies/allowlists
- Audit npm install history and monitor accounts for suspicious activity
Sources
All live incidents on Threat Watch
