tailwind-animatecss-uniform
This report shows the evidence for tailwind-animatecss-uniform@2.0.7. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 14d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17667 confirms this npm version as malicious.
Advisory
MAL-2026-17667
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-animatecss-uniform (npm)
Details
tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository. The repository commits a web/.npmrc containing a plaintext npm auth token, and its tailwind.config.js loads this package as a Tailwind CSS plugin. The package presents itself as an Animate.css integration ("A configurable, namespaced Animate.css integration for Tailwind CSS", main plugin.js) but declares a runtime dependency on a private scoped npm package (@jasperquinn/postcss-motion-helpers) that is not publicly readable, so npm audit and public scanners cannot see it; it only resolves with the token committed in the lure repository. The package has no install scripts, so --ignore-scripts does not help: the code runs when Tailwind loads the config, i.e. on `npm run dev` / `next dev`. Public analysis of the earlier package in this chain (animatecss-tailwind-adapter, by Yunus Aydın) reports that the private package contacts an operator-controlled server and runs the code it receives with full Node.js privileges. Observed directly: the lure was a "backend engineer assessment" for a fake company "Nodveta" (nodveta.com), posted as a job on Torre.ai (https://torre.ai/s/dphYpcyPn1) and shared as the private GitHub repository Nodveta-Infra/backend-engineer-assessment (a Hardhat / Express / Next.js pharmaceutical cold-chain dApp). The repository's commits are dated 2026-09-20/21, but the GitHub organization was created on 2026-09-29 and this package was published on 2026-09-28, so the history was backdated. The final commits add web/.npmrc (npm auth token) and a web/AGENTS.md + CLAUDE.md written for AI coding agents: they claim the project uses an unfamiliar Next.js version, send the agent to read docs inside node_modules (which requires installing dependencies), and tell it to commit the file. The package's repository field points to a GitHub repository that is not publicly accessible. Related packages from the same template (same description, main file, dependency list and 2.0.x versioning, each published by a different single-use npm account): animatecss-tailwind-adapter 2.0.6 (2026-07-28, depends on private @aaron205whitmore/postcss-animate-utils), animatecss-tailwind-bridge 2.0.6 (2026-09-13, depends on private @jasperquinn/postcss-motion-helpers) and tailwind-animatecss-uniform 2.0.7 (2026-09-28, depends on private @jasperquinn/postcss-motion-helpers).
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The manifest has no install lifecycle scripts, and inspected runtime code is limited to reading Animate.css and generating Tailwind styles. No concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer loads the plugin and Tailwind invokes its plugin callback.
Impact
CSS rules are added to the Tailwind build; no harmful effect was identified.
Mechanism
It parses the installed Animate.css stylesheet and adds generated base styles and utilities.
AI rationale
The manifest has no install lifecycle scripts, and inspected runtime code is limited to reading Animate.css and generating Tailwind styles. No concrete malicious behavior was found.
Evidence
plugin.jssrc/catalog.jssrc/styles.js
Independent scan evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json contains no lifecycle hooks and lists CSS tooling dependencies.
- The entry point registers a Tailwind plugin that builds styles and adds base rules and utilities when invoked.
- Catalog loading reads the installed Animate.css stylesheet for CSS parsing; style generation turns selected animations into keyframes and utilities.
- No attack behavior or network endpoint was identified in the inspected source.
Evidence against
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
25"scripts": {
"lint": "eslint . --ext .js",
"test": "node --test"
},
"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"postcss-js
High
Suspicious Lifecycle Evidence
package.json contains no lifecycle hooks and lists CSS tooling dependencies.
package.jsonView on unpkg · L25plugin.jsView file
8function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBase, addUtilities }) => {
const styles = buildStyles(loadCatalog(), config);
addBase(styles.base);
addUtilities(styles.util
High
Ai Review Evidence
The entry point registers a Tailwind plugin that builds styles and adds base rules and utilities when invoked.
plugin.jsView on unpkg · L8src/catalog.jsView file
26function loadCatalog() {
if (cachedCatalog) return cachedCatalog;
const root = postcss.parse(fs.readFileSync(animateCssPath(), 'utf8'));
const keyframes = new Map();
const animations = new Map();
root.walkAtRules(/^(?:-webkit-)?keyframes$/,
High
Ai Review Evidence
Catalog loading reads the installed Animate.css stylesheet for CSS parsing; style generation turns selected animations into keyframes and utilities.
src/catalog.jsView on unpkg · L26src/styles.jsView file
77selectAnimations(catalog, config).forEach(([publicName, animation]) => {
const keyframeName = config.namespaceKeyframes
? `${config.prefix}-${kebab(publicName)}`
: animation.keyframeName;
Object
High
Ai Review Evidence
Catalog loading reads the installed Animate.css stylesheet for CSS parsing; style generation turns selected animations into keyframes and utilities.
src/styles.jsView on unpkg · L77Findings
4 High2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceplugin.js
HighAi Review Evidencesrc/catalog.js
HighAi Review Evidencesrc/styles.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to tailwind-animatecss-uniform@2.0.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwind-animatecss-uniform@2.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.