@jackmaturan/tailwind-animate-css@2.0.3
TailwindCSS v4.0 compatible replacement for `tailwindcss-animate`.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CSS entrypoints are stylesheets, but the separately exported register plugin performs unrelated, automatic host-data disclosure to a hardcoded remote logging account. This is concrete data exfiltration when the plugin is invoked, so publication should be blocked.
Decision evidence
public snapshot- The manifest exposes an executable `./register` entrypoint.
- Calling the register function sends package-load metadata, including working directory and process ID, along with a host snapshot.
- The snapshot includes host name and user name.
- The logger sends to a hardcoded Loggly account; no recipient-specific consent gate protects the send.
- The manifest’s `prepare` hook only runs `simple-git-hooks`; the telemetry is triggered by the separate register function.
Source & flagged code
6 flagged · loading sourceA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/tailwind-animate-prefix.cssView on unpkgThe manifest exposes an executable `./register` entrypoint.
package.jsonView on unpkg · L57Findings
Affected versions and remediation
This report applies to @jackmaturan/tailwind-animate-css@2.0.3.
See all versions of @jackmaturan/tailwind-animate-css for other recorded verdicts.
- Avoid installing @jackmaturan/tailwind-animate-css@2.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.