registry / Malware / tailwind-fabric / 3.0.4

tailwind-fabric@3.0.4

A configurable, namespaced Animate.css integration for Tailwind CSS

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18082 confirms this npm version as malicious.

Advisory

MAL-2026-18082

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tailwind-fabric (npm)

Details

tailwind-fabric (3.0.1, 3.0.4) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.

References

OpenSSF/OSV advisory ADVISORY ADVISORY ADVISORY WEB

Independent LPM AI assessment

Manual Review

Independent AI assessment: manual_review. LPM AI review remains unresolved.

The inspected entry point and source implement a Tailwind animation plugin, and no concrete attack behavior was found. A required runtime dependency could not be resolved to source, so its behavior requires manual review.

Static reason

No blocking static signals were detected.

Trigger

Using the package's Tailwind plugin invokes its style-building path.

Impact

The dependency's behavior could not be assessed from the available source, leaving a review gap.

Mechanism

The style-building path imports and invokes an unavailable dependency to generate CSS.

AI rationale

Evidence

package.jsonsrc/motion.jsplugin.js

Independent scan evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

The package entry point creates a Tailwind plugin that builds and registers animation styles.
The manifest declares @aaron205whitmore/postcss-animate-utils as a runtime dependency, and src/motion.js imports and invokes it to build CSS.
That selected dependency's source was unresolved in the supplied snapshot, so its runtime behavior could not be verified.

Evidence against

No concrete attack behavior was established in the inspected package source.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 10.1 KB of source

Source & flagged code

3 flagged

plugin.jsView file

Lines 1-22javascript

1'use strict';

3const tailwindPlugin = require('tailwindcss/plugin');

4const { loadCatalog } = require('./src/catalog');

5const { normalizeOptions } = require('./src/config');

6const { buildStyles } = require('./src/styles');

8function keyframeTailwindPlugin(options = {}) {

9 const config = normalizeOptions(options);

11 return tailwindPlugin(({ addBase, addUtilities }) => {

High

Ai Review Evidence

The package entry point creates a Tailwind plugin that builds and registers animation styles.

plugin.jsView on unpkg · L3

12 const styles = buildStyles(loadCatalog(), config);

13 addBase(styles.base);

14 addUtilities(styles.utilities);

15 });

16}

18keyframeTailwindPlugin.catalog = () => loadCatalog().names.slice();

19keyframeTailwindPlugin.normalizeOptions = normalizeOptions;

21module.exports = keyframeTailwindPlugin;

package.jsonView file

Lines 5-45json

5 "main": "plugin.js",

6 "exports": "./plugin.js",

7 "files": [

8 "plugin.js",

9 "src",

10 "README.md",

src/motion.jsView file

Lines 1-23javascript

1'use strict';

3const postcss = require('postcss');

4const postcssJs = require('postcss-js');

5const

Source & flagged code

3 flagged · loading source

plugin.jsView file

3const tailwindPlugin = require('tailwindcss/plugin'); const { loadCatalog } = require('./src/catalog'); const { normalizeOptions } = require('./src/config'); const { buildStyles } = require('./src/styles'); function keyframeTailwindPlugin(options = {}) { const config = normalizeOptions(options); return tailwindPlugin(({ addB

High

Ai Review Evidence

The package entry point creates a Tailwind plugin that builds and registers animation styles.

plugin.jsView on unpkg · L3

package.jsonView file

25"scripts": { "lint": "eslint . --ext .js", "test": "node --test" }, "dependencies": { "animate.css": "^4.1.1", "postcss": "^8.4.5", "@aaron205whitmore/postcss-animate-utils": "^1.0.1", "p

High

Suspicious Dependency Evidence

The manifest declares @aaron205whitmore/postcss-animate-utils as a runtime dependency, and src/motion.js imports and invokes it to build CSS.

package.jsonView on unpkg · L25

src/motion.jsView file

Findings

3 High2 Low

HighAi Review Evidenceplugin.js

HighSuspicious Dependency Evidencepackage.json

HighSuspicious Dependency Evidencesrc/motion.js

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to tailwind-fabric@3.0.4.

See all versions of tailwind-fabric for other recorded verdicts.

Avoid installing tailwind-fabric@3.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 10:20:29.184Z (UTC).

Source advisory published: 2026-10-19 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages