Critical Malicious Code Vulnerability in tailwind-color-shine Package
Summary
MAL-2025-192641: Malicious code in tailwind-color-shine (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tailwind-color-shine package is an npm library designed to enhance the Tailwind CSS framework by providing color manipulation utilities. It is widely used in web development for creating visually appealing user interfaces. However, this package has been compromised, leading to severe security risks for any application utilizing it.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the tailwind-color-shine package. This malicious code can fully compromise any computer that has the package installed or running, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to data breaches and loss of control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-color-shineIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that the tailwind-color-shine package is uninstalled from your project. You can do this by running the following command in your terminal: npm uninstall tailwind-color-shine. Additionally, monitor your application for any suspicious activity and consider using a security tool to scan for vulnerabilities.
Conclusion
The tailwind-color-shine package has been identified as containing malicious code that poses a significant security risk. Immediate action is required to remove the package and secure any sensitive information. Continuous monitoring for vulnerabilities is recommended to protect your applications.
See every vulnerability recorded for tailwind-color-shine →
FAQ
It is an npm library that enhances the Tailwind CSS framework with additional color manipulation utilities.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
Immediately uninstall the package and rotate any secrets or keys stored on the affected computer.
Currently, there is no patched version available. It is essential to remove the package entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file. You can also check your application against this vulnerability using the Vulert playground without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
