registry / Malware / animatecss-tailwind-binary

animatecss-tailwind-binary

A configurable, namespaced Animate.css integration for Tailwind CSS

This report shows the evidence for animatecss-tailwind-binary@2.0.6, the only known version.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18068 confirms this npm version as malicious.

Advisory

MAL-2026-18068

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in animatecss-tailwind-binary (npm)

Details

animatecss-tailwind-binary (2.0.6) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.

References

OpenSSF/OSV advisory ADVISORY ADVISORY ADVISORY WEB

Independent LPM AI assessment

Manual Review

Independent AI assessment: manual_review. LPM AI review remains unresolved.

The package uses the unresolved helper in a runtime style-generation path, so its behavior cannot be cleared by the inspected source. No malicious behavior was established; manual review is needed to resolve the dependency source.

Static reason

No blocking static signals were detected.

Trigger

Using the plugin during Tailwind style generation.

Impact

The dependency's behavior and any resulting impact remain unknown.

Mechanism

The plugin builds styles through a motion helper whose implementation could not be inspected in this package snapshot.

AI rationale

Evidence

package.jsonplugin.jssrc/motion.jssrc/styles.js

Independent scan evidence

public snapshot

AI called this Manual Review at 92.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares `@jasperquinn/postcss-motion-helpers` as a runtime dependency.
The Tailwind plugin calls the style builder, which invokes the motion builder; that builder calls the imported helper.
The package snapshot does not include source for this selected runtime dependency, so its behavior could not be assessed.

Evidence against

Inspected package code uses the helper while constructing PostCSS styles; no concrete attack behavior was established in those paths.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 10.2 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 5-45json

5 "main": "plugin.js",

6 "exports": "./plugin.js",

7 "files": [

8 "plugin.js",

9 "src",

10 "README.md",

11 "LICENSE"

12 ],

13 "homepage": "https://sericpieap.github.io/animatecss-tailwind-binary/",

14 "repository": "https://github.com/sericpieap/animatecss-tailwind-binary/",

15 "author": "sericpieap",

16 "license": "MIT",

17 "keywords": [

18 "tailwindcss",

19 "tailwindcss-plugin",

20 "animate.css",

21 "animation",

22 "keyframes",

23 "motion"

24 ],

25 "scripts": {

26 "lint": "eslint . --ext .js",

27 "test": "node --test"

28 },

29 "dependencies": {

30 "animate.css": "^4.1.1",

31 "postcss": "^8.4.5",

32 "@jasperquinn/postcss-motion-helpers": "^1.0.1",

33 "postcss-js": "^3.0.3",

34 "postcss-selector-parser": "^6.0.8"

35 },

36 "devDependencies": {

High

Suspicious Dependency Evidence

The manifest declares `@jasperquinn/postcss-motion-helpers` as a runtime dependency.

package.jsonView on unpkg · L25

37 "eslint": "^8.5.0",

38 "eslint-config-airbnb-base": "15.0.0",

39 "eslint-plugin-import": "^2.25.2",

40 "tailwindcss": "^3.0.7"

41 },

42 "peerDependencies": {

43 "tailwindcss": "^3"

44 },

45 "engines": {

plugin.jsView file

Lines 1-22javascript

1'use strict';

3const tailwindPlugin = require('tailwindcss/plugin');

4const { loadCatalog } = require('./src/catalog');

5const

src/styles.jsView file

Lines 44-84javascript

45function modifierUtilities(config) {

46 if (!config.modifiers) return {};

47 const prefix = `.${config.prefix}`

src/motion.jsView file

Lines 7-34javascript

7function toPostcssOptions(config) {

8 return {

9 variables: {

10 enabled: true,

11 selector: ':root',

12 prefix: 'keyframe',

13 preserveExisting:

Source & flagged code

4 flagged · loading source

package.jsonView file

25"scripts": { "lint": "eslint . --ext .js", "test": "node --test" }, "dependencies": { "animate.css": "^4.1.1", "postcss": "^8.4.5", "@jasperquinn/postcss-motion-helpers": "^1.0.1", "postcss-js": "^3.0.3", "postcss-selector-parser": "^6.0.8" }, "devDep

High

Suspicious Dependency Evidence

The manifest declares `@jasperquinn/postcss-motion-helpers` as a runtime dependency.

package.jsonView on unpkg · L25

plugin.jsView file

8function keyframeTailwindPlugin(options = {}) { const config = normalizeOptions(options); return tailwindPlugin(({ addBase, addUtilities }) => { const styles = buildStyles(loadCatalog(), config); addBase(styles.base); addUtilities(styles.utilities); }); } keyframeTailwindPlugin.catalog = () => loadC

High

Ai Review Evidence

The Tailwind plugin calls the style builder, which invokes the motion builder; that builder calls the imported helper.

plugin.jsView on unpkg · L8

src/styles.jsView file

Findings

4 High2 Low

HighSuspicious Dependency Evidencepackage.json

HighAi Review Evidenceplugin.js

HighAi Review Evidencesrc/styles.js

HighAi Review Evidencesrc/motion.js

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to animatecss-tailwind-binary@2.0.6.

The versions list below shows the verdict for each recorded version.

Avoid installing animatecss-tailwind-binary@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 10:17:04.487Z (UTC).

Source advisory published: 2026-10-19 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

2.0.6latestshownMaliciousMalwareBlockPublishedSep 28, 2026, 11:59 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages