The 'textshape-css' package (version 1.0.0) masquerades as a Tailwind CSS typography plugin but includes obfuscated code in src/index.js that executes on module load. This code spawns a shell process that runs 'npx -y runtimedev-link@latest' with an attacker-supplied token, fetching and executing code from a remote IP address over HTTP. This behavior effectively acts as a remote code execution dropper, compromising any system that installs or runs this package. The package is a near-verbatim typosquat targeting developers searching for the legitimate '@tailwindcss/typography' plugin.

Systems with 'textshape-css' version 1.0.0 installed or running are fully compromised, as the package executes attacker-controlled code remotely. This can lead to unauthorized control over the affected system, potential data exfiltration, and persistence of malicious software. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove 'textshape-css' version 1.0.0 from all systems. Because the package grants full control to an attacker, it is critical to assume full compromise of affected systems. All secrets and credentials stored on these systems should be rotated from a different, secure machine. Monitor for any signs of persistent malicious activity and consider rebuilding affected systems.