Malicious code in tailwindcssss (npm)

The 'tailwindcssss' package on npm is identified as malicious software. Installation or execution of this package results in a full compromise of the host computer, potentially allowing an attacker to access sensitive information such as secrets and keys. The advisory warns that simply uninstalling the package may not remove all malicious components, indicating persistent or additional malware may be installed. This package affects multiple specific versions ranging from 0.2.0 through 1.11.0. No CVSS score or official patch information is available.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. The compromise is severe and persistent, with no guarantee that removal of the package alone will restore system integrity.

Immediate removal of the 'tailwindcssss' package is recommended. All secrets and keys stored on the compromised system must be rotated from a separate, secure computer. Due to the potential for persistent malware beyond the package itself, a full system investigation and remediation is advised. No official patch or fix is available; users should avoid installing this package entirely.