animate-tailwind-kit@3.0.1
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18065 confirms this npm version as malicious.
Advisory
MAL-2026-18065
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animate-tailwind-kit (npm)
Details
animate-tailwind-kit (3.0.1, 3.0.4) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The available package code follows a CSS plugin flow and shows no concrete attack. The imported runtime dependency could not be inspected, so its behavior remains unresolved and prevents a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
Tailwind invokes the plugin to build styles.
Impact
The dependency's behavior could not be assessed, so the full runtime behavior remains uncertain.
Mechanism
The style builder calls a PostCSS plugin imported from the unavailable dependency.
AI rationale
The available package code follows a CSS plugin flow and shows no concrete attack. The imported runtime dependency could not be inspected, so its behavior remains unresolved and prevents a clean verdict.
Evidence
package.jsonsrc/motion.jssrc/styles.js
Independent scan evidence
public snapshotAI called this Manual Review at 90.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest lists only lint and test scripts, with plugin.js as the package entrypoint.
- The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency, and src/motion.js imports it; the registry source for this dependency was unavailable in the supplied inspection snapshot.
- The plugin calls buildStyles when Tailwind invokes it, and buildStyles calls buildMotionBase, which applies the imported helper to PostCSS.
- The inspected catalog code reads animate.css and parses its CSS rules.
Evidence against
- The inspected entrypoint registers generated base styles and utilities with Tailwind; no concrete attack behavior was identified in the available package source.
Behavioral surface
Filesystem
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
25"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@jasperquinn/pos
High
Ai Review Evidence
The manifest lists only lint and test scripts, with plugin.js as the package entrypoint.
package.jsonView on unpkg · L2532"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
"
High
Suspicious Dependency Evidence
The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency, and src/motion.js imports it; the registry source for this dependency was unavailable in the supplied inspection snapshot.
package.jsonView on unpkg · L32plugin.jsView file
8function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.utilities);
});
Findings
7 High2 Low
HighAi Review Evidencepackage.json
HighAi Review Evidenceplugin.js
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencesrc/motion.js
HighAi Review Evidencesrc/styles.js
HighAi Review Evidencesrc/motion.js
HighAi Review Evidencesrc/catalog.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animate-tailwind-kit@3.0.1.
See all versions of animate-tailwind-kit for other recorded verdicts.
- Avoid installing animate-tailwind-kit@3.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.