Critical Malicious Code Vulnerability in tailwind-state Package
Summary
MAL-2025-191593: Malicious code in tailwind-state (npm). Affects tailwind-state versions 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tailwind-state package is a utility for managing state in applications that utilize the Tailwind CSS framework. It provides developers with an easy way to handle state changes and transitions in their UI components. However, this package has been identified as containing malicious code, which poses significant risks to applications that depend on it.
Vulnerability Detail
The vulnerability in the tailwind-state package stems from the inclusion of malicious code that can compromise the security of applications using this package. This code may lead to unauthorized access, data breaches, or other harmful actions within the application. The malicious nature of the code was identified by ReversingLabs, which reported the issue, highlighting the importance of scrutinizing third-party packages for security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-stateIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the tailwind-state package from your project until a secure version is released. You can do this by executing the following command: npm uninstall tailwind-state. This will prevent any potential exploitation of the vulnerability while you await a fix.
Conclusion
The tailwind-state package has been identified as containing malicious code, posing significant risks to applications that utilize it. It is crucial for developers to update to a patched version or remove the package entirely until a fix is available. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for tailwind-state →
FAQ
The tailwind-state package is a utility designed to help developers manage state in applications that utilize Tailwind CSS, making it easier to handle UI component state changes.
The vulnerability was discovered by ReversingLabs, which identified the presence of malicious code within the tailwind-state package.
The risks include unauthorized access to application data, potential data breaches, and other harmful actions that could compromise the integrity of the application.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities. By analyzing your package-lock.json file, Vulert can help you determine if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup or installation.
