animatecss-tailwind-presets@2.0.3
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18073 confirms this npm version as malicious.
Advisory
MAL-2026-18073
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animatecss-tailwind-presets (npm)
Details
animatecss-tailwind-presets (1.0.0, 2.0.3) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by elony16 on 2026-09-29. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected entrypoint and local code construct Tailwind CSS, with no package lifecycle hook shown. The plugin directly invokes a runtime helper whose source is unavailable, so the dependency boundary prevents a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
Tailwind invokes the package plugin during CSS generation.
Impact
The helper's behavior cannot be assessed from the available source; no concrete harmful effect is established.
Mechanism
The plugin builds CSS styles through a helper dependency whose implementation could not be inspected.
AI rationale
The inspected entrypoint and local code construct Tailwind CSS, with no package lifecycle hook shown. The plugin directly invokes a runtime helper whose source is unavailable, so the dependency boundary prevents a clean verdict.
Evidence
package.jsonsrc/motion.js
Independent scan evidence
public snapshotAI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
- src/motion.js imports that dependency and invokes it to build CSS styles.
- The plugin entrypoint calls the style builder when Tailwind invokes the plugin.
Evidence against
- The package manifest lists only lint and test scripts; no lifecycle hook is shown.
Behavioral surface
Filesystem
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
32"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
}
High
Suspicious Dependency Evidence
The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
package.jsonView on unpkg · L3225"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@jasperquinn/
High
Suspicious Dependency Evidence
The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
package.jsonView on unpkg · L25src/motion.jsView file
5const postcssAnimateUtils = require('@jasperquinn/postcss-motion-helpers');
function toPostcssOptions(config) {
return {
variables: {
High
Suspicious Dependency Evidence
Findings
5 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencesrc/motion.js
HighSuspicious Dependency Evidencesrc/motion.js
HighAi Review Evidenceplugin.js
HighSuspicious Dependency Evidencepackage.json
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animatecss-tailwind-presets@2.0.3.
See all versions of animatecss-tailwind-presets for other recorded verdicts.
- Avoid installing animatecss-tailwind-presets@2.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.