Malicious code in tailwindcss-animatecss-keyframes (npm)

The npm package tailwindcss-animatecss-keyframes version 1.0.0 was found to include malicious code or a dependency that contains malicious code. According to source reports, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the system, risking exposure of all stored secrets and keys. Removal of the package alone may not fully remediate the compromise due to potential persistence of malicious software.

Full system compromise is likely if the malicious package is installed or running. All secrets and keys stored on the affected computer are at risk of exposure. The attacker may have gained persistent control, making simple removal of the package insufficient to guarantee system integrity.

Remove the tailwindcss-animatecss-keyframes package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys from a separate, trusted computer to prevent further compromise. Conduct a thorough system investigation and remediation as the attacker may have established persistent access beyond the package itself.