Encyclopedia
npm◆ MEDIUMslopsquat⚠ ACTIVE THREAT
tailwind-merge-utils
First seen: Aug 30, 2026 0 viewsMimics: tailwind-merge
Threat Description
A hallucinated utility set wrapping tailwind-merge. Sounds like an official companion but is not published by the tailwind-merge author. Registered copies inject a build-step script that reads the project's .env file and stashes it inside a generated CSS asset, which can then leak via static hosting.
AI Hallucination Analysis
Likely AI Hallucination74%
Known to be hallucinated by: ChatGPT-4, Copilot
Remediation Guide
- Replace tailwind-merge-utils with the official tailwind-merge. 2. Rotate any secrets in .env. 3. Rebuild your static assets and purge cached CDN output. 4. Add a dependency allowlist to CI.
Related Horror Stories
Quick Facts
- Ecosystem
- npm
- Risk Level
- MEDIUM
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- tailwind-merge
- Hallucination Confidence
- 74%
Check My Project
Scan for this package