tailwind-animate-kit@2.0.6
Selective, namespaced Animate.css animations as Tailwind CSS utilities
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18078 confirms this npm version as malicious.
Advisory
MAL-2026-18078
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-animate-kit (npm)
Details
tailwind-animate-kit (2.0.6, 2.0.7, 2.0.8) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
Source inspection shows a CSS transformation plugin with no install lifecycle hook or unrelated runtime behavior. The inspected parser dependencies support this CSS processing; the package is clean.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports and invokes the Tailwind plugin during CSS configuration.
Impact
The observed effect is CSS generation; no credential handling, unrelated network activity, persistence, or destructive behavior was identified.
Mechanism
The plugin parses the installed animation stylesheet, selects classes and keyframes, and adds generated base styles and utilities.
AI rationale
Source inspection shows a CSS transformation plugin with no install lifecycle hook or unrelated runtime behavior. The inspected parser dependencies support this CSS processing; the package is clean.
Independent scan evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the source entrypoint and defines only lint and test scripts; it has no installation lifecycle hook.
- src/index.js exposes a Tailwind plugin that reads the animation catalog and adds generated base styles and utilities.
- The catalog reads and parses the installed Animate.css stylesheet, while the inspected parser dependencies provide CSS parsing, selector handling, and CSS-to-object conversion.
Evidence against
Behavioral surface
Filesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
5"main": "src/index.js",
"exports": "./src/index.js",
"files": [
"src",
"README.md",
"LICENSE"
],
"homepage": "https://seric
High
Suspicious Lifecycle Evidence
package.json points to the source entrypoint and defines only lint and test scripts; it has no installation lifecycle hook.
package.jsonView on unpkg · L524"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"de
High
Suspicious Lifecycle Evidence
package.json points to the source entrypoint and defines only lint and test scripts; it has no installation lifecycle hook.
package.jsonView on unpkg · L24src/index.jsView file
11return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.utiliti
Findings
8 High2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencesrc/index.js
HighSuspicious Dependency Evidencesrc/catalog/load-catalog.js
HighSuspicious Dependency Evidencesrc/css/build-styles.js
HighSuspicious Dependency Evidencesrc/options/defaults.js
HighSuspicious Dependency Evidencesrc/options/normalize-options.js
HighSuspicious Dependency Evidencesrc/css/select-animations.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to tailwind-animate-kit@2.0.6.
See all versions of tailwind-animate-kit for other recorded verdicts.
- Avoid installing tailwind-animate-kit@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.