animatecss-tailwind-bridge
This report shows the evidence for animatecss-tailwind-bridge@2.0.6. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.0-stage, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 14d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17666 confirms this npm version as malicious.
Advisory
MAL-2026-17666
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animatecss-tailwind-bridge (npm)
Details
animatecss-tailwind-bridge 2.0.6 was published to npm on 2026-09-13 by the account bennetwild. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository. The repository commits a web/.npmrc containing a plaintext npm auth token, and its tailwind.config.js loads this package as a Tailwind CSS plugin. The package presents itself as an Animate.css integration ("A configurable, namespaced Animate.css integration for Tailwind CSS", main plugin.js) but declares a runtime dependency on a private scoped npm package (@jasperquinn/postcss-motion-helpers) that is not publicly readable, so npm audit and public scanners cannot see it; it only resolves with the token committed in the lure repository. The package has no install scripts, so --ignore-scripts does not help: the code runs when Tailwind loads the config, i.e. on `npm run dev` / `next dev`. Public analysis of the earlier package in this chain (animatecss-tailwind-adapter, by Yunus Aydın) reports that the private package contacts an operator-controlled server and runs the code it receives with full Node.js privileges. A public write-up by a targeted developer describes this package as the dependency in a lure repository for a Solana copy-trading dashboard from a fake company "BlockRoute Labs" (blockroutelabs.com), recruited through Djinni.co. It depends on the same private package as tailwind-animatecss-uniform, which was found in a separate lure. The package's repository field points to a GitHub repository that is not publicly accessible. Related packages from the same template (same description, main file, dependency list and 2.0.x versioning, each published by a different single-use npm account): animatecss-tailwind-adapter 2.0.6 (2026-07-28, depends on private @aaron205whitmore/postcss-animate-utils), animatecss-tailwind-bridge 2.0.6 (2026-09-13, depends on private @jasperquinn/postcss-motion-helpers) and tailwind-animatecss-uniform 2.0.7 (2026-09-28, depends on private @jasperquinn/postcss-motion-helpers).
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The manifest has no install lifecycle hook, and the entrypoint performs the expected Tailwind style registration. The inspected catalog reads the installed Animate.css source; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
The plugin runs when a Tailwind configuration imports and invokes it.
Impact
It adds configurable animation CSS to the Tailwind build; no malicious effect was found.
Mechanism
It parses the installed Animate.css stylesheet and registers generated base styles and utilities.
AI rationale
The manifest has no install lifecycle hook, and the entrypoint performs the expected Tailwind style registration. The inspected catalog reads the installed Animate.css source; no concrete attack behavior was found.
Independent scan evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only lint and test scripts, with no install lifecycle hook.
- The exported plugin normalizes caller options and registers generated styles with Tailwind when invoked.
- The catalog reads and parses the installed Animate.css stylesheet to build animation data.
Evidence against
Behavioral surface
Filesystem
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
25"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"
High
Suspicious Lifecycle Evidence
package.json defines only lint and test scripts, with no install lifecycle hook.
package.jsonView on unpkg · L25plugin.jsView file
8function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.utilities
High
Ai Review Evidence
The exported plugin normalizes caller options and registers generated styles with Tailwind when invoked.
plugin.jsView on unpkg · L8src/catalog.jsView file
Findings
3 High2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceplugin.js
HighAi Review Evidencesrc/catalog.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animatecss-tailwind-bridge@2.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing animatecss-tailwind-bridge@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.