animatecss-tailwind-vectrix@2.0.7
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18074 confirms this npm version as malicious.
Advisory
MAL-2026-18074
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in animatecss-tailwind-vectrix (npm)
Details
animatecss-tailwind-vectrix (2.0.6, 2.0.7) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by cypherbyte on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The manifest and inspected entrypoint show a Tailwind CSS plugin that generates animation styles, with no install lifecycle hook or malicious behavior identified. The source facts support a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
A consumer invokes the exported Tailwind plugin during configuration or style generation.
Impact
The inspected behavior adds animation styles; no malicious effect was identified.
Mechanism
The plugin normalizes its options, loads animation data, and registers generated base styles and utilities.
AI rationale
The manifest and inspected entrypoint show a Tailwind CSS plugin that generates animation styles, with no install lifecycle hook or malicious behavior identified. The source facts support a clean verdict.
Independent scan evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports a Tailwind plugin as its main entrypoint.
- The manifest lists only lint and test scripts and declares CSS processing dependencies.
- The plugin normalizes options and builds Tailwind styles from the animation catalog.
- The catalog parses Animate.css selectors to identify animation classes.
Evidence against
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
5"main": "plugin.js",
"exports": "./plugin.js",
"files": [
"plugin.js",
"src",
"README.md",
"LICENSE"
],
"homepage": "https://github.com/minicypherbyte1/animatecss-tailwind-vectrix/",
"repository": {
"type": "git",
"url": "git+https:/
High
Ai Review Evidence
The package exports a Tailwind plugin as its main entrypoint.
package.jsonView on unpkg · L531"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@aaron205whitmore/postcss-animate-utils": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
"eslint-config-airbnb-base": "15.0.0",
"eslint-plugin-import": "^2.25.2",
"tailwin
High
Suspicious Dependency Evidence
The manifest lists only lint and test scripts and declares CSS processing dependencies.
package.jsonView on unpkg · L31plugin.jsView file
3const tailwindPlugin = require('tailwindcss/plugin');
const { loadCatalog } = require('./src/catalog');
const { normalizeOptions } = require('./src/config');
const { buildStyles } = require('./src/styles');
function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(lo
Findings
4 High2 Low
HighAi Review Evidencepackage.json
HighSuspicious Dependency Evidencepackage.json
HighAi Review Evidenceplugin.js
HighAi Review Evidencesrc/catalog.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to animatecss-tailwind-vectrix@2.0.7.
See all versions of animatecss-tailwind-vectrix for other recorded verdicts.
- Avoid installing animatecss-tailwind-vectrix@2.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.