Critical Malicious Code Vulnerability in tailwindcss-breezium Package
Summary
MAL-2025-190564: Malicious code in tailwindcss-breezium (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tailwindcss-breezium package is an npm library designed to enhance the Tailwind CSS framework by providing additional features and utilities. It is widely used in web development for creating responsive and modern user interfaces. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on.
Vulnerability Detail
The vulnerability originates from the tailwindcss-breezium package, which has been found to embed malicious code. This code can fully compromise any computer where the package is installed or running, allowing unauthorized access to sensitive information, including secrets and keys. The implications of this vulnerability are severe, as it can lead to data breaches and loss of control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwindcss-breeziumIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. Ensure that you monitor your system for any signs of compromise after removal.
Conclusion
The tailwindcss-breezium package contains a critical vulnerability due to embedded malicious code, posing significant risks to any system it is installed on. Immediate removal of the package and rotation of sensitive information is essential to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert is recommended to maintain security.
See every vulnerability recorded for tailwindcss-breezium →
FAQ
Tailwindcss-breezium is an npm package that extends the functionality of the Tailwind CSS framework, providing additional utilities for web development.
The malicious code can fully compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
You should immediately uninstall the tailwindcss-breezium package and rotate any sensitive information stored on the affected system.
No, there is currently no patched version of the tailwindcss-breezium package available. The only solution is to remove the package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check if your application is affected using the Vulert playground without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
