The tailwind-core npm package in specified versions contains embedded malicious code that compromises the host system upon installation or execution. This compromise is severe enough that all stored secrets and keys on the affected system should be rotated immediately from a different, uncompromised device. Due to the nature of the compromise, simply uninstalling the package does not ensure complete remediation, as the attacker may have established persistent control over the system.

Systems with the affected tailwind-core package installed are fully compromised, potentially allowing attackers full control. All secrets and keys stored on the system are at risk and must be rotated. The compromise may persist beyond removal of the package, indicating possible additional malicious software or backdoors.

Remove the tailwind-core package immediately from affected systems. Rotate all secrets and keys stored on the compromised systems using a separate, secure computer. Conduct a thorough investigation and remediation of the affected systems to identify and remove any additional malicious software or backdoors. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.