registry / Remote code execution / tailwind-animationpack
tailwind-animationpack
Excellent animation utilities of TailwindCSS
This report shows the evidence for tailwind-animationpack@2.3.7. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete import-time remote code execution unrelated to Tailwind animation functionality. Absence of lifecycle hooks does not mitigate activation during normal plugin loading.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A project imports/requires src/index.js, including during a Tailwind build.
Impact
Arbitrary remote code execution in the developer/build environment and stealthy background process execution.
Mechanism
Obfuscated blockchain-resolved remote payload execution with detached process spawning.
Attack narrative
The entrypoint executes a Base64-obfuscated loader at import time. It queries public Ethereum RPC/block-explorer services for a controlled transaction, converts transaction bytes into IP addresses, fetches staged payloads over HTTP, and executes them via eval or a detached `node -e` child process.
AI rationale
This is concrete import-time remote code execution unrelated to Tailwind animation functionality. Absence of lifecycle hooks does not mitigate activation during normal plugin loading.
Evidence
package.jsonsrc/index.jssrc/compat/theme.jssrc/compat/helper/bare-values.js
Network endpoints5
eth.blockscout.com/api1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- src/index.js appends obfuscated `eval(atob(...))` to the plugin entrypoint.
- Decoded payload imports http/https/zlib and child_process.spawn.
- It queries Ethereum RPCs/block explorer to derive C2 IP addresses from transaction data.
- It fetches `/0x/cls` and `/0x/ls`, then evals or detached-spawns received code.
Evidence against
- package.json has no npm lifecycle hooks.
- Other src/compat modules implement ordinary Tailwind animation utilities.
Behavioral surface
DynamicRequireEval
HighEntropyStringsMinified
Source & flagged code
4 flagged · loading sourcesrc/index.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 486057a664947d76
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = tailwind-animationgroup@2.3.7
matchedPath = src/index.js
matchedIdentity = npm:dGFpbHdpbmQtYW5pbWF0aW9uZ3JvdXA:2.3.7
similarity = 1.000
shingleOverlap = 3
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
src/index.jsView on unpkg13theme: require('./compat/theme'),
L14: }); ...
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/index.jsView on unpkg · L13src/compat/theme.jsView file
1const { getBareMilliseconds, getBareIntegers } = require('./helper/bare-values')
L2:
Findings
2 High2 Medium3 Low
HighSame File Env Network Executionsrc/index.js#virtual:base64:round1
HighKnown Malware Source Fingerprint Signaturesrc/index.js
MediumDynamic Requiresrc/compat/theme.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to tailwind-animationpack@2.3.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwind-animationpack@2.3.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.