tailwind-kinetix npm package is malware — full machine compromise, no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-fgxr-cqw4-cpp6) for the npm package tailwind-kinetix on 2026-11-10. Every published version (= 0) contains embedded malicious code (CWE-506) and there are no patched versions — the package should be treated as malicious in its entirety. Any machine where the package was installed or executed must be considered fully compromised, with potential attacker access to secrets, keys, and credentials. The package sees roughly 331 downloads per month. Removal of the package does not guarantee removal of any malware it may have deployed. No CVE is assigned; the advisory recommends immediate secret rotation from a clean machine.
What to do
- Stop using and uninstall tailwind-kinetix; block it in npm policies and CI dependency checks
- Rotate all secrets, keys, tokens, and credentials stored on or accessible from affected machines, using a clean computer
- Rebuild/reimage affected machines and audit for persistence, backdoors, and exfiltration
- Audit dependency lockfiles and install history for exposure to the package
Sources
All live incidents on Threat Watch
