Hey! We didn't change anything related to Windows in those versions. Could it be that previous versions were manually accepted / allowed before and that the same needs to happen with the new version?

4.2.4 work
4.3.0 was failing, however, now, same installation process is fine. I would guess it was Windows update issue causing Smart App Control false positive and blocking @tailwindcss/oxide-win32-x64-msvc

This is an issue with how the native Rust-based .node binaries for the new Oxide engine are compiled and distributed in the newer Tailwind v4 versions.

Starting recently, Microsoft has enforced much stricter VerifiedAndReputableDesktop code integrity policies on enterprise environments (especially impacting development tools like Node and Rust binaries that try to execute unsigned or improperly signed native extensions).

Because the tailwindcss-oxide.win32-x64-msvc.node file in versions newer than 4.2.3 lacks the specific Authenticode signing certificate required by your corporate environment's Application Control / Windows Defender Application Control (WDAC) policy, Windows blocks the DLL from loading entirely, returning 0xc0e90002 (Code Integrity blocked the file).

There are two ways to fix this:

1. The Infrastructure fix (If you have IT privileges):
   You need to add a path-based or hash-based exclusion in your corporate WDAC / Code Integrity policy for node_modules/@tailwindcss/oxide-win32-x64-msvc/*.node. If you are using Microsoft Endpoint Manager, this is under the Defender Application Control policies.

2. The Developer workaround (If you don't have IT privileges):
   Continue pinning to 4.2.3 as you noted, or switch to running your build process inside WSL2 (Windows Subsystem for Linux). When you run Tailwind inside WSL2, it downloads the linux binaries (@tailwindcss/oxide-linux-x64-gnu) which execute natively within the Linux kernel boundary and completely bypass the Windows Code Integrity Enterprise signing policies.

If you don't want to use WSL, you will have to wait for the Tailwind team to start explicitly signing their Windows release artifacts with an EV Code Signing certificate, which you can track by opening an Issue (not a Discussion) on this repo requesting Windows Authenticode signing for the Oxide binaries.