animate-twcss-pack@2.0.6
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18067 confirms this npm version as malicious.
Advisory
MAL-2026-18067
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animate-twcss-pack (npm)
Details
animate-twcss-pack (2.0.6) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by enterprise0908 on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The package source shows the unresolved helper is on the style-building path, but does not establish malicious behavior. Review remains unresolved because the helper’s source was unavailable.
Static reason
No blocking static signals were detected.
Trigger
Using the Tailwind plugin to build styles.
Impact
The helper’s behavior and any resulting impact could not be assessed from the available source.
Mechanism
The plugin’s style builder invokes a PostCSS helper whose source was unavailable for inspection.
AI rationale
The package source shows the unresolved helper is on the style-building path, but does not establish malicious behavior. Review remains unresolved because the helper’s source was unavailable.
Evidence
package.jsonplugin.jssrc/motion.jssrc/styles.js
Independent scan evidence
public snapshotAI called this Manual Review at 79.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares the unresolved @jasperquinn/postcss-motion-helpers dependency at ^1.0.1.
- plugin.js imports styles, which imports motion.js; motion.js loads the unresolved helper and passes it to PostCSS when building styles.
- The helper’s source could not be verified, so its behavior remains unresolved.
Evidence against
- The inspected package entrypoint uses the helper to build PostCSS styles; no malicious behavior was established in the inspected source.
Behavioral surface
Filesystem
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
32"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
"
High
Suspicious Dependency Evidence
package.json declares the unresolved @jasperquinn/postcss-motion-helpers dependency at ^1.0.1.
package.jsonView on unpkg · L32plugin.jsView file
6const { buildStyles } = require('./src/styles');
function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBa
High
Ai Review Evidence
plugin.js imports styles, which imports motion.js; motion.js loads the unresolved helper and passes it to PostCSS when building styles.
plugin.jsView on unpkg · L612const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.utilities);
});
}
keyframeTailwindPlugin.catalog = () => loadCatalog()
High
Findings
6 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighAi Review Evidenceplugin.js
HighAi Review Evidencesrc/motion.js
HighAi Review Evidencesrc/motion.js
HighAi Review Evidencesrc/styles.js
HighAi Review Evidenceplugin.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animate-twcss-pack@2.0.6.
See all versions of animate-twcss-pack for other recorded verdicts.
- Avoid installing animate-twcss-pack@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.