Malicious Code Injection in tailwind-fabric: A Critical Vulnerability
Summary
MAL-2026-18082: Malicious code in tailwind-fabric (npm). Affects tailwind-fabric versions 3.0.1 – 3.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tailwind-fabric is a Tailwind CSS plugin designed to enhance the styling capabilities of web applications. It allows developers to utilize Tailwind CSS features seamlessly. However, this package has been compromised, exposing users to potential security risks due to malicious code embedded within a private dependency.
Vulnerability Detail
The vulnerability originates from the tailwind-fabric package versions 3.0.1 and 3.0.4, which are linked to a malicious campaign. The package requires a private scoped dependency, @aaron205whitmore/postcss-animate-utils, that is not publicly accessible. This dependency contains malicious code that executes when the tailwind.config.js file loads the plugin, potentially compromising the application. The malicious code is designed to run without the need for any install scripts or network calls, making it particularly insidious.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-fabricIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tailwind-fabric package until a secure version is released. Alternatively, you can manually remove the dependency from your project and replace it with a trusted Tailwind CSS plugin.
Conclusion
The tailwind-fabric package has been compromised, exposing users to significant security risks through malicious code in a private dependency. It is crucial for developers to update or remove the affected package to safeguard their applications.
See every vulnerability recorded for tailwind-fabric →
FAQ
tailwind-fabric is a Tailwind CSS plugin that enhances styling capabilities for web applications.
The vulnerability allows malicious code to execute within your application, potentially leading to data breaches or unauthorized access.
If you are using tailwind-fabric versions 3.0.1 or 3.0.4, update to a patched version immediately or remove the package from your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. Check your application for vulnerabilities at Vulert Scanner.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
