Which versions of tailwindthml-flips are malicious?

Every published version of tailwindthml-flips on npm is considered malicious. Remove the package entirely.

How do I remediate tailwindthml-flips if I installed it?

tailwindthml-flips establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed tailwindthml-flips — how do I know if it already compromised me?

If tailwindthml-flips was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tailwindthml-flips part of a known attack campaign?

Yes — tailwindthml-flips is associated with the GHSA-wqqm-f8q9-pgmm campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwindthml-flips across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tailwindthml-flips (all published versions).

Malicious package

tailwindthml-flipsnpm

Advisory published Apr 15, 2026Updated Apr 23, 2026

tailwindthml-flips is a confirmed malicious npm package (MAL-2026-2910) that opens a backdoor for remote access. Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tailwindthml-flips (npm)

MAL-2026-2910

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwindthml-flips

What this malware does

tailwindthml-flips is a malicious npm package that when imported downloads a C2 dropper (part of PolinRider campaign) from crypto transactions and executes it.

The package tailwindthml-flips was found to contain malicious code.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

all versions

Every published version of this package is considered malicious — remove it entirely.

Indicators of compromise (SHA-256)

e254d7121a22468bf34d16aa70b6ec0fd35169b4d2ee2e857357f0463141ddd2

9d8d70853abaa891c16378fe8319ddcb579ea9fa28fc20b2990e7bec2af4cdca

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for tailwindthml-flips (all published versions).
If you installed it — respond
tailwindthml-flips establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If tailwindthml-flips was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tailwindthml-flips on npm has been identified as a malicious package (all published versions flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-wqqm-f8q9-pgmm

References

Credits

Amazon Inspector · finder
indece · finder

Detect & block this

O3 blocks tailwindthml-flips-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database