@jackmaturan/tailwind-animate-css@2.0.2
TailwindCSS v4.0 compatible replacement for `tailwindcss-animate`.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe optional registration API sends identifying user and host metadata to a package-configured Loggly recipient without a separate telemetry consent check. Because the stylesheet entrypoints are separate and the manifest's prepare command only runs simple-git-hooks, this is a conditional runtime disclosure, not an automatic install-time attack.
Decision evidence
public snapshot- package.json exposes scripts/register.cjs as a separate ./register entrypoint.
- Calling the registration function logs a package-load event with the version, working directory, process ID, and collected host information.
- The collected fields include the username, hostname, home and temporary directories, CPU details, memory, and uptime.
- The logger sends through a Loggly transport using a package-configured subdomain that decodes to rantir.
- The manifest's prepare command runs simple-git-hooks; the separate log:os command explicitly runs the host snapshot script.
- The logger is exposed through a separate registration entrypoint and runs when its function is called; the manifest does not configure it as an install lifecycle hook.
Source & flagged code
8 flagged · loading sourceA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/tailwind-animate-prefix.cssView on unpkgpackage.json exposes scripts/register.cjs as a separate ./register entrypoint.
package.jsonView on unpkg · L54Findings
Affected versions and remediation
This report applies to @jackmaturan/tailwind-animate-css@2.0.2.
See all versions of @jackmaturan/tailwind-animate-css for other recorded verdicts.
- Review the evidence and your use of @jackmaturan/tailwind-animate-css@2.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.