registry / Remote code execution / tailwind-modernanimation
tailwind-modernanimation
Excellent animation utilities of TailwindCSS
This report shows the evidence for tailwind-modernanimation@2.3.8, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package deliberately conceals a remote code loader in its runtime entrypoint. Its network-selected payload execution is concrete malicious behavior.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer imports or loads the package entrypoint.
Impact
An attacker can run arbitrary code in the consuming user's Node environment.
Mechanism
Obfuscated network-backed remote code execution
Attack narrative
The package entrypoint appends an immediate eval of a Base64-encoded loader. The decoded loader searches Ethereum transaction data for command infrastructure, retrieves a payload over HTTP, then evaluates it directly or starts a detached Node process containing it. This behavior is unrelated to Tailwind animation utilities and gives a remote operator code execution when the package is loaded.
AI rationale
The package deliberately conceals a remote code loader in its runtime entrypoint. Its network-selected payload execution is concrete malicious behavior.
Evidence
src/index.jspackage.json
Network endpoints5
eth.blockscout.com/api1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest loads src/index.js as the package entrypoint.
- The entrypoint immediately evaluates a concealed Base64 program.
- Static decoding shows the concealed program queries Ethereum services for a command location, downloads a payload, and evaluates it or launches it as a detached Node process.
Evidence against
- package.json has no npm lifecycle hook.
- The visible Tailwind utility code is consistent with an animation plugin.
Behavioral surface
DynamicRequireEval
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourcesrc/index.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 486057a664947d76
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = tailwind-animationgroup@2.3.7
matchedPath = src/index.js
matchedIdentity = npm:dGFpbHdpbmQtYW5pbWF0aW9uZ3JvdXA:2.3.7
similarity = 1.000
shingleOverlap = 3
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
src/index.jsView on unpkg14eval(atob('[redacted]
High
Ai Review Evidence
The entrypoint immediately evaluates a concealed Base64 program.
src/index.jsView on unpkg · L1413theme: require('./compat/theme'),
L14: }); ...
L15:
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/index.jsView on unpkg · L13Findings
4 High2 Medium3 Low
HighSame File Env Network Executionsrc/index.js#virtual:base64:round1
HighKnown Malware Source Fingerprint Signaturesrc/index.js
HighAi Review Evidencepackage.json
HighAi Review Evidencesrc/index.js
MediumDynamic Requiresrc/compat/theme.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to tailwind-modernanimation@2.3.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwind-modernanimation@2.3.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.