signalledger-diagnostics@2.0.6
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18076 confirms this npm version as malicious.
Advisory
MAL-2026-18076
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in signalledger-diagnostics (npm)
Details
signalledger-diagnostics (2.0.6) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected package source shows a Tailwind CSS plugin with no install lifecycle hook, but it imports an unresolved runtime dependency that is called as a PostCSS plugin. The dependency's behavior cannot be verified from the available source, so the package requires manual review without evidence of an attack.
Static reason
No blocking static signals were detected.
Trigger
Tailwind invokes the plugin callback to generate styles.
Impact
The unavailable dependency prevents a complete source-based assessment; the inspected package code does not establish malicious behavior.
Mechanism
The callback reaches a PostCSS plugin imported from an unavailable dependency, so its behavior could not be verified.
AI rationale
The inspected package source shows a Tailwind CSS plugin with no install lifecycle hook, but it imports an unresolved runtime dependency that is called as a PostCSS plugin. The dependency's behavior cannot be verified from the available source, so the package requires manual review without evidence of an attack.
Evidence
package.jsonplugin.jssrc/motion.js
Independent scan evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares @aaron205whitmore/postcss-animate-utils as a runtime dependency.
- src/motion.js imports that dependency and calls it as a PostCSS plugin.
- The plugin builds animation styles through src/motion.js when Tailwind invokes its callback.
Evidence against
- The inspected package manifest contains no install lifecycle hook; its scripts are lint and test.
- The inspected plugin path uses the dependency to build and register CSS styles.
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
32"@aaron205whitmore/postcss-animate-utils": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
High
Suspicious Dependency Evidence
package.json declares @aaron205whitmore/postcss-animate-utils as a runtime dependency.
package.jsonView on unpkg · L32src/motion.jsView file
5const postcssAnimateUtils = require('@aaron205whitmore/postcss-animate-utils');
function toPostcssOptions(config) {
return {
variables: {
enabled: true,
se
High
Suspicious Dependency Evidence
src/motion.js imports that dependency and calls it as a PostCSS plugin.
src/motion.jsView on unpkg · L528const processor = postcss([postcssAnimateUtils(toPostcssOptions(config))]);
const result = processor.process('', { from: undefined }).sync();
return postcssJs.objectify(resul
High
Findings
4 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencesrc/motion.js
HighSuspicious Dependency Evidencesrc/motion.js
HighAi Review Evidenceplugin.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to signalledger-diagnostics@2.0.6.
See all versions of signalledger-diagnostics for other recorded verdicts.
- Avoid installing signalledger-diagnostics@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.