registry / Malware / tailwindcss-animatemotion / 1.0.7

tailwindcss-animatemotion@1.0.7

A configurable, namespaced Animate.css integration for Tailwind CSS

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18086 confirms this npm version as malicious.

Advisory

MAL-2026-18086

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tailwindcss-animatemotion (npm)

Details

tailwindcss-animatemotion (1.0.7) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.

References

OpenSSF/OSV advisory ADVISORY ADVISORY ADVISORY WEB

Independent LPM AI assessment

Manual Review

Independent AI assessment: manual_review. LPM AI review remains unresolved.

The inspected package source follows a CSS generation path and shows no confirmed attack behavior. A required runtime dependency is unresolved and its implementation could not be inspected, so the package cannot be cleared or classified as malicious from this source review.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading the plugin and building Tailwind styles invokes the helper through the PostCSS pipeline.

Impact

The helper's behavior remains unresolved, so the package's runtime behavior cannot be fully assessed.

Mechanism

The package imports the helper and uses it to generate CSS variables; the helper's implementation is unavailable for inspection.

AI rationale

Evidence

package.jsonsrc/motion.js

Independent scan evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json declares @aaron205whitmore/postcss-animate-utils as a required runtime dependency.
The Tailwind plugin callback builds styles and registers them as base styles and utilities.
src/motion.js imports the scoped helper and invokes it as a PostCSS plugin to generate base styles.
src/catalog.js reads the installed Animate.css file and parses its keyframes.

Evidence against

The inspected package code shows a CSS generation path; it contains no confirmed network or credential transfer behavior.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 10.2 KB of source

Source & flagged code

7 flagged

src/catalog.jsView file

Lines 1-46javascript

1'use strict';

3const fs = require('fs');

4const postcss = require('postcss');

5const selectorParser = require('postcss-selector-parser');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/catalog.jsView on unpkg · L3

7let cachedCatalog;

9function animateCssPath() {

10 try {

11 return require.resolve('animate.css/animate.css');

12 } catch (error) {

13 const wrapped = new Error('animatecss-tailwind-adapter: unable to resolve animate.css/animate.css');

14 wrapped.cause = error;

15 throw wrapped;

16 }

17}

19function sourceClasses(selector) {

20 const classes = [];

21 selectorParser(selectors => selectors.walkClasses(node => classes.push(node.value)))

22 .processSync(selector);

23 return classes.filter(name => name.startsWith('animate__'));

24}

26function loadCatalog() {

27 if (cachedCatalog) return cachedCatalog;

29 const root = postcss.parse(fs.readFileSync(animateCssPath(), 'utf8'));

30 const keyframes = new Map();

31 const animations = new Map();

33 root.walkAtRules(/^(?:-webkit-)?keyframes$/, (rule) => {

High

Ai Review Evidence

src/catalog.js reads the installed Animate.css file and parses its keyframes.

src/catalog.jsView on unpkg · L26

34 if (!keyframes.has(rule.params)) keyframes.set(rule.params, rule.clone());

35 });

37 root.walkRules((rule) => {

38 const names = sourceClasses(rule.selector)

39 .filter(name => name !== 'animate__animated')

40 .map(name => name.slice('animate__'.length));

41 if (names.length === 0) return;

43 let animationName;

44 rule.walkDecls(/^(?:-webkit-)?animation-name$/, declaration => {

45 animationName = declaration.value;

46 });

package.jsonView file

Lines 9-49json

9 "src",

10 "README.md",

11 "LICENSE"

12 ],

13 "homepage": "https://sericpieap.github.io/animatecss-tailwind-adapter/",

14 "repository": "https://github.com/sericpieap/animatecss-tailwind-adapter/",

plugin.jsView file

Lines 1-22javascript

1'use strict';

3const tailwindPlugin = require('tailwindcss/plugin');

4const { loadCatalog } = require('./src/catalog');

5const

src/motion.jsView file

Lines 1-34javascript

1'use strict';

3const postcss = require('postcss');

4const postcssJs = require('postcss-js');

5const

src/styles.jsView file

Lines 44-84javascript

45function modifierUtilities(config) {

46 if (!config.modifiers) return {};

47 const prefix = `.${config.prefix}`

Source & flagged code

7 flagged · loading source

src/catalog.jsView file

3package = tailwindcss-animatemotion; repositoryIdentity = animatecss-tailwind-adapter; dependency = postcss L3: const fs = require('fs'); L4: const postcss = require('postcss'); L5: const selectorParser = require('postcss-selector-parser');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/catalog.jsView on unpkg · L3

26function loadCatalog() { if (cachedCatalog) return cachedCatalog; const root = postcss.parse(fs.readFileSync(animateCssPath(), 'utf8')); const keyframes = new Map(); const animations = new Map(); root.walkAtRules(/^(?:-we

High

Ai Review Evidence

src/catalog.js reads the installed Animate.css file and parses its keyframes.

src/catalog.jsView on unpkg · L26

package.jsonView file

29"dependencies": { "animate.css": "^4.1.1", "postcss": "^8.4.5", "@aaron205whitmore/postcss-animate-utils": "^1.0.1", "postcss-js": "^3.0.3", "postcss-sel

Findings

7 High1 Medium2 Low

HighCopied Package Dependency Bridgesrc/catalog.js

HighSuspicious Dependency Evidencepackage.json

HighAi Review Evidenceplugin.js

HighAi Review Evidencesrc/motion.js

HighAi Review Evidencesrc/catalog.js

HighAi Review Evidencesrc/styles.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to tailwindcss-animatemotion@1.0.7.

See all versions of tailwindcss-animatemotion for other recorded verdicts.

Avoid installing tailwindcss-animatemotion@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 10:13:52.159Z (UTC).

Source advisory published: 2026-10-19 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code