Malicious Code Injection in tool-tailwindcss-cosmology-native Package
Summary
MAL-2025-189958: Malicious code in tool-tailwindcss-cosmology-native (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tool-tailwindcss-cosmology-native package is part of the npm ecosystem, primarily used for styling applications with Tailwind CSS. It is designed to facilitate the integration of Tailwind CSS into various projects. However, this package has been identified as part of a malicious campaign that exploits npm's publishing mechanisms, leading to significant security concerns.
Vulnerability Detail
The vulnerability stems from the package being associated with the tea.xyz token reward campaign, which has been flooding npm with malicious packages. These packages contain scripts that automatically modify the package.json file, removing private flags, altering version numbers, and generating random package names. This behavior not only inflates developer reputation scores but also leads to the pollution of the npm registry, potentially compromising other projects that depend on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tool-tailwindcss-cosmology-nativeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the tool-tailwindcss-cosmology-native package from your project by executing the following command: npm uninstall tool-tailwindcss-cosmology-native. This will prevent any malicious code from executing until a safe version is available.
Conclusion
The tool-tailwindcss-cosmology-native package has been identified as containing malicious code that can compromise your project. It is essential to take immediate action by updating or uninstalling the package and utilizing monitoring tools like Vulert to safeguard your applications from future vulnerabilities.
See every vulnerability recorded for tool-tailwindcss-cosmology-native →
FAQ
It is an npm package used for integrating Tailwind CSS into applications, but it has been compromised with malicious code.
The malicious code modifies your package.json file and can lead to the publication of unauthorized packages, potentially compromising your project's integrity.
You should uninstall the package immediately and monitor your project for any unusual behavior.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Regularly update your dependencies, use tools like Vulert for monitoring, and review package sources before installation.
