Malicious code in tailwind-theme-engine (npm)

The 'tailwind-theme-engine' npm package versions 1.0.0, 1.1.0, 2.0.0, 2.1.0, 3.0.0, 3.1.0, and 4.0.0 have been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code presence means that attackers may have gained full control over the system, and all secrets and keys stored on the system should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee the removal of all malicious software introduced.

Systems with the affected versions of 'tailwind-theme-engine' installed are at risk of full compromise. Attackers may have gained complete control over the system, potentially exposing all stored secrets and keys. This represents a critical security risk requiring immediate remediation.

Remove the 'tailwind-theme-engine' package immediately from affected systems. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is documented; thus, avoidance and removal are the primary mitigations.