tailwind-kinetic@2.0.6
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18084 confirms this npm version as malicious.
Advisory
MAL-2026-18084
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwind-kinetic (npm)
Details
tailwind-kinetic (2.0.6, 2.0.8) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The manifest has no install lifecycle hook, and inspected entrypoint behavior is limited to CSS parsing and Tailwind style generation. The prepared PostCSS dependencies expose parser and CSS transformation code consistent with that use.
Static reason
No blocking static signals were detected.
Trigger
A consumer loads the package and invokes it as a Tailwind plugin.
Impact
The observed effect is CSS generation; no credential, account, file disclosure, or remote execution behavior was identified.
Mechanism
The plugin parses Animate.css keyframes and adds base styles and utilities using normalized options.
AI rationale
The manifest has no install lifecycle hook, and inspected entrypoint behavior is limited to CSS parsing and Tailwind style generation. The prepared PostCSS dependencies expose parser and CSS transformation code consistent with that use.
Independent scan evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hook, and the entrypoint loads a Tailwind plugin.
- The plugin reads Animate.css, parses its keyframes, and generates CSS utilities using caller options; no attack behavior was identified.
Evidence against
Behavioral surface
Filesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
1{
"name": "tailwind-kinetic",
"version": "2.0.6",
"description": "A configurable, namespaced Animate.css integration for Tailwind CSS",
"main": "./src/index.js",
"ex
High
Suspicious Lifecycle Evidence
The manifest has no install lifecycle hook, and the entrypoint loads a Tailwind plugin.
package.jsonView on unpkg · L1.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/package.jsonView file
1{
"name": "postcss",
"version": "8.5.31",
"description": "Tool for transforming styles with JS plugins",
"keywords": [
"css",
"manipulation",
"parser",
"pos
High
Ai Review Evidence
The plugin reads Animate.css, parses its keyframes, and generates CSS utilities using caller options; no attack behavior was identified.
.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/package.jsonView on unpkg · L1Findings
8 High2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/lib/postcss.js
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/lib/at-rule.js
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/lib/comment.js
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/lib/container.js
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/lib/css-syntax-error.js
HighAi Review Evidence.lpm-dependency-evidence-557ea40a-83d5-4f8a-8d64-f7daa15f7131/0/npm-linux/lib/declaration.js
Affected versions and remediation
This report applies to tailwind-kinetic@2.0.6.
See all versions of tailwind-kinetic for other recorded verdicts.
- Avoid installing tailwind-kinetic@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.