tailwindcss-effect-lab@0.0.0-stage
Temporary package placeholder for staged publishing
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18087 confirms this npm version as malicious.
Advisory
MAL-2026-18087
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwindcss-effect-lab (npm)
Details
tailwindcss-effect-lab (0.0.0-stage, 1.6.7) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The inspected files show a placeholder package with no declared executable behavior or concrete attack surface.
Static reason
No blocking static signals were detected.
Trigger
No execution trigger is declared in package.json.
Impact
No package attack behavior was identified.
Mechanism
No lifecycle hook or runtime entrypoint is declared.
AI rationale
The inspected files show a placeholder package with no declared executable behavior or concrete attack surface.
Independent scan evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json contains only package metadata and identifies the package as a stub; it declares no lifecycle scripts or runtime entrypoints.
Evidence against
Behavioral surface
NoLicense
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
1{
"name": "tailwindcss-effect-lab",
"version": "0.0.0-stage",
"stub": true,
"description": "Temporary package placeholder for staged publishing"
}
High
Suspicious Lifecycle Evidence
package.json contains only package metadata and identifies the package as a stub; it declares no lifecycle scripts or runtime entrypoints.
package.jsonView on unpkg · L1Findings
1 High1 Low
HighSuspicious Lifecycle Evidencepackage.json
LowNo License
Affected versions and remediation
This report applies to tailwindcss-effect-lab@0.0.0-stage.
See all versions of tailwindcss-effect-lab for other recorded verdicts.
- Avoid installing tailwindcss-effect-lab@0.0.0-stage. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.