@jackmaturan/tailwind-animate-css@2.0.7
TailwindCSS v4.0 compatible replacement for `tailwindcss-animate`.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe registration plugin sends identifying runtime telemetry to a hard-coded Loggly account, and the package documentation does not disclose it. Because this behavior requires calling the separate registration function, the evidence supports a warning rather than a publish block.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Calling the exported `./register` plugin function.
Impact
The collector receives machine identifiers and local paths without disclosure in the package documentation.
Mechanism
The function creates a Loggly transport with embedded credentials and submits a package-load event containing the working directory and collected OS and user details.
AI rationale
The registration plugin sends identifying runtime telemetry to a hard-coded Loggly account, and the package documentation does not disclose it. Because this behavior requires calling the separate registration function, the evidence supports a warning rather than a publish block.
Evidence
scripts/loggly-logger.cjsscripts/register.cjsREADME.mdpackage.json
Network endpoints1
rantir.loggly.com
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports a separate register plugin that logs a package-load event when its function is called.
- The logger uses a hard-coded Loggly token and subdomain; the decoded subdomain is `rantir`, making the endpoint `rantir.loggly.com`.
- The log includes the working directory and collected host details, including hostname, username, home directory, and temporary directory.
- The README presents the package as CSS animation utilities and documents CSS imports, without disclosing the logging behavior.
Evidence against
- The ordinary package entry points are CSS files; the logging code is behind the separate `./register` export.
- The logger runs when the exported registration function is called, rather than simply when the CSS package is installed or imported.
Behavioral surface
EnvironmentVars
Source & flagged code
7 flaggeddist/tailwind-animate-prefix.cssView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/tailwind-animate-prefix.cssView on unpkgscripts/loggly-logger.cjsView file
•matchType = malicious_source_fingerprint_signature
signature = 437d337b06603bcc
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @jackmaturan/tailwind-animate-css@2.0.3
matchedPath = scripts/loggly-logger.cjs
matchedIdentity = npm:[redacted]:2.0.3
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
scripts/loggly-logger.cjsView on unpkgFindings
2 High6 Medium2 Low
HighSemantic Analysis Limiteddist/tailwind-animate-prefix.css
HighKnown Malware Source Fingerprint Signaturescripts/loggly-logger.cjs
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencescripts/loggly-logger.cjs
MediumAi Review Evidencescripts/loggly-logger.cjs
MediumAi Review Evidencescripts/register.cjs
MediumAi Review EvidenceREADME.md
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @jackmaturan/tailwind-animate-css@2.0.7.
See all versions of @jackmaturan/tailwind-animate-css for other recorded verdicts.
- Review the evidence and your use of @jackmaturan/tailwind-animate-css@2.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.