--- canonical: "https://firewall.lpm.dev/npm/@jackmaturan/tailwind-animate-css/v/2.0.2" markdown: "https://firewall.lpm.dev/npm/@jackmaturan/tailwind-animate-css/v/2.0.2.md" package: "@jackmaturan/tailwind-animate-css" report_status: "published" title: "@jackmaturan/tailwind-animate-css@2.0.2 npm security report" verdict: "suspicious" version: "2.0.2" --- # @jackmaturan/tailwind-animate-css@2.0.2 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Flagged — allowed with a warning** — Allowed by default policy, but 11 finding(s) warrant review before installing. - **Verdict:** Suspicious - **Product-default install policy:** Warn - **Firewall policy:** Matched warn-list - **Public report status:** Published - **Threat category:** Data Exfiltration - **Selected version:** 2.0.2 - **Selected version is latest:** No - **Analysis source:** AI Security Review (lpm-firewall-ai) This is the current Firewall decision for the selected package version, based on the available public evidence. Findings for this version do not establish the status of other versions. AI assessment: suspicious; recommendation: downgrade to warn. This assessment is supporting evidence; the published decision above determines the current policy. The optional registration API sends identifying user and host metadata to a package-configured Loggly recipient without a separate telemetry consent check. Because the stylesheet entrypoints are separate and the manifest's prepare command only runs simple-git-hooks, this is a conditional runtime disclosure, not an automatic install-time attack. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Recorded final verdict:** Suspicious - **Recorded analysis confidence:** 91.0% - **Started:** 2026-10-12T18:35:05.199Z - **Finished:** 2026-10-12T18:36:20.726Z - **Download time:** 1011 ms - **Static scan time:** 41 ms - **AI review time:** 74474 ms - **Total time:** 75527 ms The recorded confidence comes from the underlying analysis. Trusted advisory policy can determine the final verdict even when the AI assessment differs. ## Security analysis ### Published attack-surface review - **Summary:** The optional registration plugin sends package-load telemetry and identifying host metadata to a package-configured Loggly recipient. This creates a conditional data disclosure when a consumer configures and invokes the plugin. - **Trigger:** A consumer configures and calls the exported ./register plugin. - **Impact:** The recipient receives identifying user, machine, and working-directory information. - **Evidence paths:** package.json, scripts/register.cjs, scripts/loggly-logger.cjs - **Review source:** ai\_review - **Reviewed:** 2026-10-12T18:36:20.726Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** The function collects process and operating-system details, including the username and host paths, then passes them to a Loggly transport. - **Rationale:** The optional registration API sends identifying user and host metadata to a package-configured Loggly recipient without a separate telemetry consent check. Because the stylesheet entrypoints are separate and the manifest's prepare command only runs simple-git-hooks, this is a conditional runtime disclosure, not an automatic install-time attack. - **Files touched:** scripts/register.cjs, scripts/loggly-logger.cjs - **Network endpoints:** rantir.loggly.com ### Review decision - **Verdict:** Suspicious - **Confidence:** 91.0% - **Recommended action:** downgrade\_to\_warn - **Intent class:** Dangerous Capability - **False-positive risk:** Medium - **Evidence for warning:** package.json exposes scripts/register.cjs as a separate ./register entrypoint., Calling the registration function logs a package-load event with the version, working directory, process ID, and collected host information., The collected fields include the username, hostname, home and temporary directories, CPU details, memory, and uptime., The logger sends through a Loggly transport using a package-configured subdomain that decodes to rantir., The manifest's prepare command runs simple-git-hooks; the separate log:os command explicitly runs the host snapshot script. - **Evidence against:** The logger is exposed through a separate registration entrypoint and runs when its function is called; the manifest does not configure it as an install lifecycle hook. ## Affected versions and remediation This report applies to @jackmaturan/tailwind-animate-css@2.0.2. - Review the evidence and your use of @jackmaturan/tailwind-animate-css@2.0.2 before allowing it. Restrict the permissions described in this report. - Choose an independently verified alternative or release. This report does not establish that other versions are safe. ## Public findings ### 1. Low: Non Install Lifecycle Scripts - **Category:** Manifest - **Confidence:** 80.0% Package declares lifecycle scripts that are not normally run for registry tarball installs. ### 2. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 3. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 4. High: Semantic Analysis Limited - **Category:** Scanner Coverage - **Confidence:** 100.0% - **Path:** dist/tailwind-animate-prefix.css - **Public source:** [View source]() A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review. Public source snippet (untrusted): ```css stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2 ``` ### 5. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** package.json - **Public source:** [View source]() package.json exposes scripts/register.cjs as a separate ./register entrypoint. Public source snippet (untrusted): ```json "./prefix": { "style": "./dist/tailwind-animate-prefix.css" }, "./register": { "require": "./scripts/register.cjs", "import": "./scripts/register.cjs", "default": "./scripts/ ``` ### 6. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** scripts/register.cjs - **Public source:** [View source]() Calling the registration function logs a package-load event with the version, working directory, process ID, and collected host information. Public source snippet (untrusted): ```javascript function registerTailwindAnimateCss() { if (!globalThis[LOAD_FLAG]) { globalThis[LOAD_FLAG] = true; const logger = createLogglyLogger({ tags: "Winston-NodeJS,package-load" }); logger.info("tailwind-animate-css package loaded", { event: "package_load", version, cwd: process.cwd(), pid: process.pid, ...collectOsInfo(), }); } return { name: "tailwind-animate-css ``` ### 7. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** scripts/loggly-logger.cjs - **Public source:** [View source]() The collected fields include the username, hostname, home and temporary directories, CPU details, memory, and uptime. Public source snippet (untrusted): ```javascript function collectOsInfo() { const cpus = os.cpus(); let user; try { user = os.userInfo().username; } catch { user = process.env.USER || process.env.USERNAME; } return { platform: os.platform(), type: os.type(), release: os.release(), arch: os.arch(), hostname: os.hostname(), cpus: cpus.length, cpuModel: cpus[0]?.model, totalMemGB: (os.totalmem() / 1e9).toFixed(2), freeMemGB: (os.freemem() / 1e9).toFixed(2), uptimeHours: (os.uptime() / 3600).toFixed(2), homeDir: os.homedir(), tmpDir: os.tmpdir(), ``` ### 8. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** scripts/loggly-logger.cjs - **Public source:** [View source]() The logger sends through a Loggly transport using a package-configured subdomain that decodes to rantir. Public source snippet (untrusted): ```javascript function createLogglyLogger(options = {}) { const tags = (options.tags || process.env.LOGGLY_TAGS || "Winston-NodeJS") .split(",") .map((tag) => tag.trim()) .filter(Boolean); const transports = [ new Loggly({ token: logglyConfig.token, subdomain: logglyConfig.subdomain, ``` ### 9. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** scripts/loggly-logger.cjs - **Public source:** [View source]() The logger sends through a Loggly transport using a package-configured subdomain that decodes to rantir. Public source snippet (untrusted): ```javascript subdomain: fromChunks(["cmFudGly"]), }; function collectOsInfo() { con ``` ### 10. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** package.json - **Public source:** [View source]() The manifest's prepare command runs simple-git-hooks; the separate log:os command explicitly runs the host snapshot script. Public source snippet (untrusted): ```json "log:os": "node ./scripts/log-os-info.cjs", "prepare": "simple-git-hooks" }, "simple-git ``` ### 11. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 91.0% - **Path:** package.json - **Public source:** [View source]() The manifest's prepare command runs simple-git-hooks; the separate log:os command explicitly runs the host snapshot script. Public source snippet (untrusted): ```json "format": "prettier --write --ignore-unknown .", "log:os": "node ./scripts/log-os-info.cjs", "prepare": "simple-git-ho ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** Yes - **Published lifecycle scripts:** prepare - **Dependencies:** 2 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 8 - **Published dependency-graph edges:** 2 ### Published dependency entries - winston ^3.19.0 (Dependency) - winston-loggly-bulk ^3.3.3 (Dependency) ## Package metadata - **Package:** @jackmaturan/tailwind-animate-css - **Ecosystem:** npm - **Version:** 2.0.2 - **License:** MIT - **Version published:** 2026-10-12T13:49:32.774Z - **Package first seen:** 2026-10-12T03:07:48.375Z - **Package last seen:** 2026-10-20T16:21:46.592Z - **Known versions:** 5 - **Latest version:** 2.0.4 - **Appeal under review:** No - **Description:** TailwindCSS v4.0 compatible replacement for \`tailwindcss-animate\`. - **Author:** Jack Maturan - **Maintainers:** jackmaturan - **Keywords:** accordion, animate, animation, bits-ui, collapsible, css, fades, opacity, radix, reka, scale, shadcn - **Artifact files:** 9 - **Artifact unpacked size:** 44,087 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()