Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

Malware in tailwind-hide-scrollbar

Malware discovered in the npm package tailwind-hide-scrollbar. Systems with this package installed are considered fully compromised and require immediate remediation.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
Attack vectors
Affected entities
  • tailwind-hide-scrollbar

The npm package tailwind-hide-scrollbar has been identified as containing malware. According to the GitHub Advisory (GHSA-97j6-7w7w-7vj3), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the package installation, given the potential for full system compromise.\n\nUsers should treat any system that has run this package as potentially fully compromised and take appropriate incident response measures.

Indicators of compromise

Packages
  • tailwind-hide-scrollbar

Remediation

  • Immediately rotate all secrets, keys, and credentials from a different, uncompromised computer
  • Remove the tailwind-hide-scrollbar package from all affected systems
  • Conduct a full security audit and forensic analysis of any system that had this package installed
  • Monitor affected systems for signs of unauthorized access or persistence mechanisms
  • Consider rebuilding or reimaging systems that had this package installed to ensure complete removal of any malicious software

Sources

  1. GitHub Advisory GHSA-97j6-7w7w-7vj3 · GitHub Advisory Database

Cite this entry

"Malware in tailwind-hide-scrollbar." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malware-in-tailwind-hide-scrollbar-01bpix

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. resolvedcritical

    Malicious code in depcruise-wrap-stream-in-html (npm)

    depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.

    npmCompromised packageDependency confusionTyposquatting
  2. containedcritical

    Malicious code in akamaijs-sensor (npm)

    The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.

    npmCompromised packageMalicious commit
  3. containedcritical

    Malicious code in gunzip-js (npm)

    The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.

    npmCompromised package
  4. resolvedcritical

    Malicious code in @velliajs/discord (npm)

    @velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.

    npmCompromised packageMalicious commit