registry / Data exfiltration / @jackmaturan/tailwind-animate-css / 2.0.4

@jackmaturan/tailwind-animate-css@2.0.4

TailwindCSS v4.0 compatible replacement for `tailwindcss-animate`.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The package contains a real, undisclosed transfer of identifying host data when its optional registration plugin is invoked. Because the path requires explicit plugin use and is not part of installation or the documented CSS import flow, classify it as suspicious and warn rather than block.

Static reason

No blocking static signals were detected.

Trigger

A consumer imports and invokes the package's registration plugin.

Impact

The selected machine and user identifiers are disclosed to the configured Loggly account.

Mechanism

The plugin creates a Loggly logger and records package-load data, including the working directory, process ID, hostname, username, and system details.

AI rationale

Evidence

package.jsonscripts/register.cjsscripts/loggly-logger.cjs.lpm-dependency-evidence-b1271d88-0f15-4d6d-b07a-dccb43b84bd1/0/npm-linux/lib/winston/transports/http.js

Network endpoints1

rantir.loggly.com

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The separately exported register plugin sends a one-time package-load event containing the working directory, process ID, and collected machine and user details.
The logger uses a fixed Loggly configuration; the console setting adds a console transport but does not gate the Loggly transport.
The inspected HTTP transport sends log data in a POST request.

Evidence against

The package's prepare hook runs simple-git-hooks; the telemetry path is exposed through a separate registration export.
The README's documented usage imports the CSS stylesheet, not the registration plugin.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.98 KB of source

Source & flagged code

8 flagged

dist/tailwind-animate-prefix.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tailwind-animate-prefix.cssView on unpkg

scripts/register.cjsView file

7function registerTailwindAnimateCss() { if (!globalThis[LOAD_FLAG]) { globalThis[LOAD_FLAG] = true; const logger = createLogglyLogger({ tags: "Winston-NodeJS,package-load" }); logger.info("tailwind-animate-css package loaded", { event: "package_load", version, cwd: process.cwd(), pid: process.pid, ...collectOsInf

Medium

Ai Review Evidence

The separately exported register plugin sends a one-time package-load event containing the working directory, process ID, and collected machine and user details.

scripts/register.cjsView on unpkg · L7

scripts/loggly-logger.cjsView file

10const logglyConfig = { token: fromChunks(["MzY3YWMxOTEtNWRmNC00", "NTlmLTg3MzQtNjMyMWZhNDIzZGQx"]), subdomain: fromChunks(["cmFudGly"]), }; function collectOsInfo() { const cpus = os.cpus(); let user; try { user = os.userInfo().username; } catch { user = process.env.USER || process.env.USERNAME; } return { platform: os.platform(), type: os.type(), release: os.release(), arch: os.arch(

Medium

Ai Review Evidence

The separately exported register plugin sends a one-time package-load event containing the working directory, process ID, and collected machine and user details.

scripts/loggly-logger.cjsView on unpkg · L10

44function createLogglyLogger(options = {}) { const tags = (options.tags || process.env.LOGGLY_TAGS || "Winston-NodeJS") .split(",") .map((tag) => tag.trim()) .filter(Boolean); const transports = [ new Loggly({ token: logglyConfig.token, subdomain: logglyConfig.subdomain, tags, json: true, }), ]; if (process.env.TAILWIND_ANIMATE_CSS_LOG_CONSOLE === "1") { transports.push(new winston.transports.Console

Medium

Ai Review Evidence

The logger uses a fixed Loggly configuration; the console setting adds a console transport but does not gate the Loggly transport.

scripts/loggly-logger.cjsView on unpkg · L44

59if (process.env.TAILWIND_ANIMATE_CSS_LOG_CONSOLE === "1") { transports.push(new winston.transports.Console({ format: winston.format.simple() })); } return winston.createLogger({ level: "info", format:

Medium

Ai Review Evidence

The logger uses a fixed Loggly configuration; the console setting adds a console transport but does not gate the Loggly transport.

scripts/loggly-logger.cjsView on unpkg · L59

.lpm-dependency-evidence-b1271d88-0f15-4d6d-b07a-dccb43b84bd1/0/npm-linux/lib/winston/transports/http.jsView file

242const req = (this.ssl ? https : http).request({ ...this.options, method: 'POST', host: this.host, port: this.port, path: `/${path.replace(/^\//, '')}`, headers: headers, auth: (auth && auth.username && auth.password) ? (`${auth.username}:${auth.password}`) : '', agent: this.age

Medium

Ai Review Evidence

The inspected HTTP transport sends log data in a POST request.

.lpm-dependency-evidence-b1271d88-0f15-4d6d-b07a-dccb43b84bd1/0/npm-linux/lib/winston/transports/http.jsView on unpkg · L242

package.jsonView file

75"prepare": "simple-git-hooks" }, "simple-git-hooks": { "pre-commit": "pnpx lint-staged",

Medium

Ai Review Evidence

The separately exported register plugin sends a one-time package-load event containing the working directory, process ID, and collected machine and user details.

package.jsonView on unpkg · L75

57"./register": { "require": "./scripts/register.cjs", "import": "./scripts/register.cjs", "default": "./scripts/r

Medium

Ai Review Evidence

The separately exported register plugin sends a one-time package-load event containing the working directory, process ID, and collected machine and user details.

package.jsonView on unpkg · L57

Source & flagged code

8 flagged · loading source

dist/tailwind-animate-prefix.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tailwind-animate-prefix.cssView on unpkg

scripts/register.cjsView file

Medium

Ai Review Evidence

The separately exported register plugin sends a one-time package-load event containing the working directory, process ID, and collected machine and user details.

scripts/register.cjsView on unpkg · L7

Findings

1 High8 Medium2 Low

HighSemantic Analysis Limiteddist/tailwind-animate-prefix.css

MediumEnvironment Vars

MediumAi Review Evidencescripts/register.cjs

MediumAi Review Evidencescripts/loggly-logger.cjs

MediumAi Review Evidence.lpm-dependency-evidence-b1271d88-0f15-4d6d-b07a-dccb43b84bd1/0/npm-linux/lib/winston/transports/http.js

MediumAi Review Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @jackmaturan/tailwind-animate-css@2.0.4.

See all versions of @jackmaturan/tailwind-animate-css for other recorded verdicts.

Review the evidence and your use of @jackmaturan/tailwind-animate-css@2.0.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 16:21:23.172Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code