Critical Malicious Code Vulnerability in tailwindcss-uniform Package
Summary
MAL-2026-17882: Malicious code in tailwindcss-uniform (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tailwindcss-uniform package is a utility for managing uniform styles in Tailwind CSS projects, allowing developers to streamline their styling process. However, this package has been found to contain malicious code that compromises the security of any system it is installed on, making it a significant threat to developers and their applications.
Vulnerability Detail
The vulnerability originates from the tailwindcss-uniform package, which has been identified as containing embedded malicious code. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to data breaches and loss of control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwindcss-uniformIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package and securing your system. It is recommended to avoid using the tailwindcss-uniform package altogether until a secure alternative is found.
Conclusion
The tailwindcss-uniform package poses a critical security risk due to the presence of malicious code. Immediate action is required to remove the package and secure any sensitive information. Developers should remain vigilant and consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for tailwindcss-uniform →
FAQ
Tailwindcss-uniform is a utility package designed to help developers manage uniform styles in Tailwind CSS projects.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
You should immediately uninstall the tailwindcss-uniform package and rotate any sensitive information stored on your system.
No, there is currently no patched version available for the tailwindcss-uniform package. It is advised to remove it entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
