The @tailwind-ts/eslint-plugin npm package, specifically versions 0.1.0, 0.2.0, and 0.3.0, is a malicious package that pretends to be an ESLint plugin for Tailwind CSS but instead executes unrelated Polymarket Kelly stake math code and a postinstall dropper. During npm install, the postinstall script fetches a remote tgz bundle from a mutable Vercel-hosted URL without any integrity verification, extracts it, installs dependencies, and executes a JavaScript file that runs a syncSession function. This allows arbitrary attacker-controlled code execution on the victim's machine at install time. The package name and README are deceptive, and the remote code source is unrelated to any legitimate Tailwind or ESLint publisher. The compromise is severe enough that any machine with this package installed should be treated as fully compromised.

Arbitrary attacker-controlled JavaScript code executes on the machine during package installation, leading to full system compromise. Attackers may gain control over the affected system, potentially accessing all stored secrets and keys. The malicious code is delivered via an unverified remote resource, increasing the risk of further undetected malicious payloads. Removal of the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is available for this malicious package. Immediate removal of the @tailwind-ts/eslint-plugin package versions 0.1.0, 0.2.0, and 0.3.0 is strongly recommended. Systems with this package installed should be considered fully compromised; therefore, all secrets, credentials, and keys stored on those systems must be rotated from a separate, trusted environment. Monitor for any signs of persistent compromise and consider rebuilding affected systems to ensure complete remediation.