MalwarePublished 25 Jun 2026Updated 15 Jul 2026

textshape-css (npm) · Malicious Code

Affects textshape-cssSource GCVE Database

Malicious package : remove textshape-css and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6475

What to do

Remove textshape-css from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtextshape-css	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'textshape-css' version 1.0.0 is a malicious typosquat of the legitimate Tailwind CSS typography plugin. It contains obfuscated code that executes immediately upon import or require, spawning a shell process that downloads and runs an unpinned third-party package from an attacker-controlled server. This results in remote code execution and full system compromise. Removal of the package does not guarantee eradication of all malicious components. Immediate secret and key rotation is advised.

Impact

Systems with 'textshape-css' version 1.0.0 installed or running are fully compromised, as the package executes attacker-controlled code remotely. This can lead to unauthorized control over the affected system, potential data exfiltration, and persistence of malicious software. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment.

Defensive guidance

The recommended mitigation is to immediately remove 'textshape-css' version 1.0.0 from all systems. Because the package grants full control to an attacker, it is critical to assume full compromise of affected systems. All secrets and credentials stored on these systems should be rotated from a different, secure machine. Monitor for any signs of persistent malicious activity and consider rebuilding affected systems.

Summary

The 'textshape-css' package (version 1.0.0) masquerades as a Tailwind CSS typography plugin but includes obfuscated code in src/index.js that executes on module load. This code spawns a shell process that runs 'npx -y runtimedev-link@latest' with an attacker-supplied token, fetching and executing code from a remote IP address over HTTP. This behavior effectively acts as a remote code execution dropper, compromising any system that installs or runs this package. The package is a near-verbatim typosquat targeting developers searching for the legitimate '@tailwindcss/typography' plugin.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:52 UTC

Technical details

References

Community reviews