MalwarePublished 19 Oct 2026Updated 29 Oct 2026

tailwindcss-visual-kit (npm) · Malicious Code

Affects tailwindcss-visual-kitSource GCVE Database

Malicious package : remove tailwindcss-visual-kit and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18090

What to do

Remove tailwindcss-visual-kit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwindcss-visual-kit	Affected =0.0.0-stage =1.3.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The tailwindcss-visual-kit npm package versions 0.0.0-stage and 1.3.6 are associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded. The malicious payload resides in a private scoped package that requires an npm token to access and is not present in the public registry. The publicly available package tarball contains no install scripts or network code, and no direct supply-chain attack behavior was observed in the analyzed package contents. Multiple related packages were published under various accounts over several months.

Impact

The malicious payload is delivered via a private dependency that executes when the plugin is loaded, potentially allowing code execution in development environments that load this plugin. The public package itself does not contain direct malicious code or network activity. There is no evidence of supply-chain attack behavior in the public package contents. The impact is limited to environments where the private dependency can be resolved and executed.

Defensive guidance

Since the malicious payload resides in a private dependency requiring an npm token, avoiding use of the affected tailwindcss-visual-kit versions (0.0.0-stage and 1.3.6) is recommended. Users should verify dependencies and avoid installing packages from untrusted sources or accounts. Monitoring for related packages published under suspicious accounts is advised. No direct remediation is available for the public package itself as it contains no install scripts or network code.

Summary

The tailwindcss-visual-kit package versions 0.0.0-stage and 1.3.6 are linked to a fake job interview campaign distributing malicious code via a private dependency (@jasperquinn/postcss-motion-helpers). This private package is inaccessible publicly and requires an npm token embedded in a lure repository to resolve. The malicious code executes when tailwind.config.js loads the plugin and the development server starts. However, analysis of the public package tarball found no install-time scripts, network calls, credential reads, fetch-and-execute mechanisms, or obfuscated payloads. The payload is delivered solely through the private dependency, which was not retrieved during analysis. Twenty-six related packages under seventeen accounts were published between July and October 2026.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:52 UTC

Technical details

References

Community reviews