The npm package 'textshape-css' version 1.0.0 is a malicious typosquat of the legitimate Tailwind CSS typography plugin. It contains obfuscated code that executes immediately upon import or require, spawning a shell process that downloads and runs an unpinned third-party package from an attacker-controlled server. This results in remote code execution and full system compromise. Removal of the package does not guarantee eradication of all malicious components. Immediate secret and key rotation is advised.