animatecss-tailwind-presets@1.0.0
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18073 confirms this npm version as malicious.
Advisory
MAL-2026-18073
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animatecss-tailwind-presets (npm)
Details
animatecss-tailwind-presets (1.0.0, 2.0.3) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by elony16 on 2026-09-29. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected package code appears focused on generating Tailwind styles from Animate.css. A runtime dependency is unresolved and its source is unavailable, so the dependency review policy requires manual review rather than a clean verdict; this is not evidence of malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
The Tailwind plugin is invoked and builds motion styles.
Impact
The dependency's behavior cannot be assessed from the available source; no concrete attack impact is established.
Mechanism
The package imports @jasperquinn/postcss-motion-helpers as a PostCSS plugin, but that dependency's source could not be inspected.
AI rationale
The inspected package code appears focused on generating Tailwind styles from Animate.css. A runtime dependency is unresolved and its source is unavailable, so the dependency review policy requires manual review rather than a clean verdict; this is not evidence of malicious behavior.
Evidence
package.jsonsrc/motion.js
Independent scan evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
- The motion module imports that dependency and passes it to PostCSS when building motion styles.
- The package exposes a Tailwind plugin that loads catalog and style modules when invoked.
- The dependency source was unavailable for inspection, so its runtime behavior could not be verified.
Evidence against
- The manifest lists lint and test scripts but no install lifecycle hook.
- The inspected catalog code reads Animate.css and parses CSS selectors and keyframes.
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
25"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
"eslint-config-airbnb-base": "15.0.0",
"eslint-plugin-import": "^2.25.2",
"tailwindcss": "^
High
Suspicious Dependency Evidence
The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
package.jsonView on unpkg · L25src/motion.jsView file
1'use strict';
const postcss = require('postcss');
const postcssJs = require('postcss-js');
const postcssAnimateUtils = require('@jasperquinn/postcss-motion-helpers');
function toPostcssOptions(config) {
return {
variables: {
enabled: true,
selector: ':root',
prefix: 'keyframe',
preserveExisting: false,
values: {
duration: config.duration,
delay: config.delay,
iterationCount: config.iterationCount
High
Suspicious Dependency Evidence
The motion module imports that dependency and passes it to PostCSS when building motion styles.
src/motion.jsView on unpkg · L1Findings
4 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencesrc/motion.js
HighAi Review Evidenceplugin.js
HighSuspicious Dependency Evidencesrc/catalog.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animatecss-tailwind-presets@1.0.0.
See all versions of animatecss-tailwind-presets for other recorded verdicts.
- Avoid installing animatecss-tailwind-presets@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.