
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
tailwind-tree
Advanced tools
A utility for writing deeply nested and composable Tailwind CSS classes using an expressive tree structure, supporting responsive and interactive variants for Tailwind v3 and v4.
Tailwind Tree is a utility designed for writing deeply nested, composable Tailwind CSS classes using a simple and expressive tree structure. It simplifies the management of complex class combinations with responsive and interactive variants, supporting both Tailwind v3 and Tailwind v4.
hover:, md:, focus:, etc.tailwind-mergepnpm add tailwind-tree
# or
npm install tailwind-tree
# or
yarn add tailwind-tree
Instead of manually writing long utility strings, use twTree for cleaner, conditional, deeply nested Tailwind class composition.
<div class="bg-amber-500 text-nowrap hover:bg-slate-600 hover:text-clip md:focus:text-blue-700" />
twTreeimport { twTree } from 'tailwind-tree';
<div
className={twTree([
'bg-amber-500 text-nowrap',
{
hover: 'bg-slate-600 text-clip',
md: { focus: 'text-blue-700' },
},
])}
/>;
twTree([
'text-white',
isActive ? 'bg-green-500' : 'bg-green-300',
{
hover: [
'underline opacity-50',
isFocused ? 'bg-blue-200' : 'bg-blue-100',
{
active: 'scale-105 font-semibold',
},
],
focus: [
'ring-2',
{
visible: ['ring-green-500', isError ? 'ring-red-500' : 'ring-yellow-500'],
},
],
},
anotherCondition ? 'p-4' : 'p-2',
'font-bold tracking-wide',
]);
Supports:
hover:active, focus:visible)
twTree(...)must be integrated into the Tailwind build pipeline to ensure your classes are discovered and preserved during purging.
Choose the right setup based on your Tailwind version:
@tailwind-tree/extractor)Use the official extractor to enable precise class extraction:
pnpm add -D @tailwind-tree/extractor
// tailwind.config.js
import { extractTwTree } from '@tailwind-tree/extractor';
export default {
content: [
{
files: ['./src/**/*.{ts,tsx,js,jsx}'],
extract: extractTwTree(),
},
],
theme: {
extend: {},
},
plugins: [],
};
✅ This approach eliminates redundant or missing classes by parsing twTree(...) directly.
@tailwind-tree/vite-plugin)Since Tailwind v4 removed extractors, use the official plugin to inject safelisted classes:
pnpm add -D @tailwind-tree/vite-plugin
// vite.config.ts
import { twTreePlugin } from '@tailwind-tree/vite-plugin';
import tailwindcss from '@tailwindcss/vite';
import react from '@vitejs/plugin-react';
export default defineConfig({
plugins: [
react(),
twTreePlugin(), // <--- this adds all twTree classes to Tailwind safelist
tailwindcss(),
],
});
After adding the plugin to your Vite configuration, you must include the following import in your main CSS file. This is essential for the plugin to function correctly.
@import 'tailwindcss';
@import '@tailwind-tree/vite-plugin/safelist'; // <--- add safelist
This import ensures that all classes generated by twTree(...) calls are included in the final build.
🧠 Note: Tailwind v4 may still generate redundant classes because it scans all string content. This is a limitation in Tailwind itself, not
twTree.
The twTree function accepts a second options parameter:
twTree(input, options?)
| Option | Type | Default | Description |
|---|---|---|---|
merge | boolean | true | Whether to apply tailwind-merge to deduplicate conflicting classes |
prefix | string | "" | Prefix to prepend to every class name |
twTree(['bg-red-500', { hover: ['bg-red-600'] }], {
merge: false,
prefix: 'tw-',
});
// → "tw-bg-red-500 tw-hover:bg-red-600"
| Package | Description |
|---|---|
tailwind-tree | Core twTree logic for nested class generation |
@tailwind-tree/extractor | Tailwind v3 content extractor |
@tailwind-tree/vite-plugin | Tailwind v4 Vite plugin for safelisting classes |
MIT © Shervin Ghajar
Made with 💙 by @shervin-ghajar
FAQs
A utility for writing deeply nested and composable Tailwind CSS classes using an expressive tree structure, supporting responsive and interactive variants for Tailwind v3 and v4.
We found that tailwind-tree demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.