Critical Malicious Code Vulnerability in @lui-ui/lui-tailwindcss Package
Summary
MAL-2025-191244: Malicious code in @lui-ui/lui-tailwindcss (npm). Affects @lui-ui/lui-tailwindcss versions 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @lui-ui/lui-tailwindcss package is a utility library designed for integrating Tailwind CSS with UI components. It provides developers with pre-built components that can be easily styled using Tailwind's utility-first approach. However, this package has been compromised, leading to severe security risks for users who have it installed.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within version 0.1.2 of the @lui-ui/lui-tailwindcss package, which is part of the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from the user's environment and publish them to GitHub. It can also propagate itself to other NPM packages owned by the user and may destroy the user's home directory, leading to complete system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @lui-ui/lui-tailwindcssIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package. Users should ensure that they do not run any applications that depend on this package until it has been completely uninstalled.
Conclusion
The @lui-ui/lui-tailwindcss package has been compromised, posing significant security risks to users. Immediate action is required to uninstall the package and secure any potentially compromised credentials. Stay vigilant and utilize tools like Vulert to monitor for vulnerabilities in your dependencies.
See every vulnerability recorded for @lui-ui/lui-tailwindcss →
FAQ
You should uninstall the package immediately using the command: npm uninstall @lui-ui/lui-tailwindcss.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Keeping this package installed can lead to the theft of sensitive information, including tokens and credentials, and may allow an attacker to gain full control of your system.
After uninstalling the package, you should rotate all secrets and keys that may have been compromised. Additionally, review your system for any other signs of compromise.
It is currently unknown if future versions will be safe. Always monitor the package's repository for updates and security advisories.
