The malicious better-tailwindcss package (version 4.6.3) published on npm declares both runtime and development dependencies on itself resolved from an untrusted HTTP source (http://pack.nppacks.com/npm/better-tailwindcss) without TLS or integrity hashes. During npm install, this causes arbitrary, mutable code from that source to be fetched and installed, including any install or postinstall scripts which execute on the installer's machine. The shipped code is a Babel plugin clone unrelated to the legitimate better-tailwindcss project, confirming this is a namespace squatting attack used as a delivery vehicle for malicious code.

Users installing better-tailwindcss version 4.6.3 risk executing arbitrary code from an untrusted source during installation, potentially compromising their systems. The malicious package can run install scripts, enabling code execution on the installer's machine. This undermines supply chain security and trust in the npm ecosystem for this package name.

No official patch or fix is indicated. Users should avoid installing better-tailwindcss version 4.6.3 from npm and verify package sources carefully. Prefer the legitimate better-tailwindcss project and confirm dependencies resolve from trusted registries over HTTPS with integrity verification. Monitor npm advisories for updates or official vendor guidance.