tailwindcss-3d-animate
Add 3D transforms to your TailwindCSS project
This report shows the evidence for tailwindcss-3d-animate@1.2.2. 5 of 6 known versions are blocked or flagged. The newest version, 0.0.1-security.0, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe import-time obfuscated loader provides a concrete staged remote code-execution chain. It is not needed for the advertised Tailwind plugin behavior.
Decision evidence
public snapshot- The main module immediately evaluates a large Base64-encoded, heavily obfuscated payload on import.
- Decoded payload code loads HTTP, HTTPS, compression, URL, and child-process capabilities; it reads ETH_RPC_URL and queries Ethereum RPC services.
- The decoded payload obtains data from blockchain transactions, decrypts it, then executes the recovered code with eval or a detached child process.
- This behavior is unrelated to Tailwind CSS transforms and permits remotely controlled code execution when the package is imported.
- package.json contains no npm lifecycle scripts.
- The visible plugin code before the appended payload implements Tailwind 3D utility and animation configuration.
- No package source file writes local files or explicitly harvests credentials.
Source & flagged code
3 flagged · loading sourceThe main module immediately evaluates a large Base64-encoded, heavily obfuscated payload on import.
index.jsView on unpkg · L1Package source references a known benign dynamic code generation pattern.
index.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
Findings
Affected versions and remediation
This report applies to tailwindcss-3d-animate@1.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing tailwindcss-3d-animate@1.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.