animatecss-tailwind-vectrix@2.0.6
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18074 confirms this npm version as malicious.
Advisory
MAL-2026-18074
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animatecss-tailwind-vectrix (npm)
Details
animatecss-tailwind-vectrix (2.0.6, 2.0.7) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by cypherbyte on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected package code performs CSS generation and local Animate.css parsing. The declared runtime dependency `@aaron205whitmore/postcss-animate-utils` could not be resolved for source inspection, so its invoked behavior remains unknown.
Static reason
No blocking static signals were detected.
Trigger
Using the package’s Tailwind plugin to build styles.
Impact
The dependency’s behavior cannot be assessed from the available source, so this review cannot establish whether it introduces an attack surface.
Mechanism
The package passes the unresolved dependency’s export to PostCSS as a plugin while generating base styles.
AI rationale
The inspected package code performs CSS generation and local Animate.css parsing. The declared runtime dependency `@aaron205whitmore/postcss-animate-utils` could not be resolved for source inspection, so its invoked behavior remains unknown.
Evidence
package.jsonsrc/motion.js
Independent scan evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares `@aaron205whitmore/postcss-animate-utils` as a runtime dependency.
- The runtime imports that dependency and invokes it as a PostCSS plugin when building styles.
- The package entrypoint builds and registers CSS styles through Tailwind’s `addBase` and `addUtilities` callbacks.
- The visible catalog code reads and parses the Animate.css stylesheet to collect animation rules.
Evidence against
- The inspected first-party implementation shows CSS generation and local stylesheet parsing; it does not establish malicious behavior.
Behavioral surface
Filesystem
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
29"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@aaron205whitmore/postcss-animate-utils": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
High
Suspicious Dependency Evidence
The manifest declares `@aaron205whitmore/postcss-animate-utils` as a runtime dependency.
package.jsonView on unpkg · L29src/motion.jsView file
3const postcss = require('postcss');
const postcssJs = require('postcss-js');
const postcssAnimateUtils = require('@aaron205whitmore/postcss-animate-utils');
function toPostcssOptions(config) {
return {
variables: {
enabled: true,
selector: ':root',
prefix: 'keyframe',
prese
High
Suspicious Dependency Evidence
The runtime imports that dependency and invokes it as a PostCSS plugin when building styles.
src/motion.jsView on unpkg · L327function buildMotionBase(config) {
const processor = postcss([postcssAnimateUtils(toPostcssOptions(config))]);
const result = processor.process('', { from: undefined }).sync();
Findings
5 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencesrc/motion.js
HighSuspicious Dependency Evidencesrc/motion.js
HighAi Review Evidenceplugin.js
HighAi Review Evidencesrc/catalog.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animatecss-tailwind-vectrix@2.0.6.
See all versions of animatecss-tailwind-vectrix for other recorded verdicts.
- Avoid installing animatecss-tailwind-vectrix@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.