tailwind-animaflow-kit@2.0.6
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18077 confirms this npm version as malicious.
Advisory
MAL-2026-18077
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-animaflow-kit (npm)
Details
tailwind-animaflow-kit (2.0.6) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected code follows the package’s stated Tailwind animation purpose, but a directly imported runtime dependency was unresolved and its source could not be reviewed. This leaves a material source gap, so manual review is appropriate.
Static reason
No blocking static signals were detected.
Trigger
Tailwind invokes the plugin callback while processing its configuration.
Impact
The dependency’s behavior could not be verified, so the review cannot establish whether this path is benign.
Mechanism
The callback builds styles through a motion helper that imports and invokes an unavailable dependency.
AI rationale
The inspected code follows the package’s stated Tailwind animation purpose, but a directly imported runtime dependency was unresolved and its source could not be reviewed. This leaves a material source gap, so manual review is appropriate.
Evidence
src/motion.jspackage.jsonplugin.js
Independent scan evidence
public snapshotAI called this Manual Review at 83.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares an animation utility dependency that could not be resolved for source inspection.
- The plugin invokes its style builder when Tailwind runs the plugin callback.
- The motion builder imports the unresolved dependency and calls it to create CSS processing behavior.
Evidence against
- The inspected entrypoint builds styles and registers them with Tailwind; no separate attack behavior was identified in that path.
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
29"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@aaron205whitmore/postcss-animate-utils": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"
High
Suspicious Dependency Evidence
The manifest declares an animation utility dependency that could not be resolved for source inspection.
package.jsonView on unpkg · L29plugin.jsView file
8function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.utilities);
});
}
keyf
High
Ai Review Evidence
The plugin invokes its style builder when Tailwind runs the plugin callback.
plugin.jsView on unpkg · L8src/motion.jsView file
Findings
4 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighAi Review Evidenceplugin.js
HighSuspicious Dependency Evidencesrc/motion.js
HighSuspicious Dependency Evidencesrc/motion.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to tailwind-animaflow-kit@2.0.6.
See all versions of tailwind-animaflow-kit for other recorded verdicts.
- Avoid installing tailwind-animaflow-kit@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.