registry / Malware / tailwindcss-keyframe-kit

tailwindcss-keyframe-kit

Tailwind CSS 3 plugin that emits only the Animate.css animations you select, with namespaced keyframes

This report shows the evidence for tailwindcss-keyframe-kit@3.0.2. 3 of 3 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18088 confirms this npm version as malicious.

Advisory

MAL-2026-18088

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tailwindcss-keyframe-kit (npm)

Details

tailwindcss-keyframe-kit (3.0.0, 3.0.1, 3.0.2) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. src/generators/motion-base.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.

References

OpenSSF/OSV advisory ADVISORY ADVISORY ADVISORY WEB

Independent LPM AI assessment

Manual Review

Independent AI assessment: manual_review. LPM AI review remains unresolved.

The package uses an unresolved runtime dependency while generating CSS, and its behavior could not be inspected. The available source does not establish an attack, so the unresolved dependency requires manual review.

Static reason

No blocking static signals were detected.

Trigger

Using the Tailwind plugin invokes its style-generation path.

Impact

The dependency's possible runtime effects remain unresolved; no concrete harm is established by the available source.

Mechanism

That path imports and calls an animation utility dependency whose source was unavailable for inspection.

AI rationale

Evidence

package.jsonsrc/generators/motion-base.jssrc/generators/index.jssrc/index.js

Independent scan evidence

public snapshot

AI called this Manual Review at 88.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares an unresolved runtime dependency on an animation utility package.
The plugin imports that dependency and invokes it while building CSS styles.
The available source does not establish the imported dependency's behavior.

Evidence against

The inspected package entry point uses the dependency through its style-generation path; no concrete attack behavior was established in the available source.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 13.3 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 11-48json

11 ],

12 "homepage": "https://devmatt000.github.io/tailwindcss-keyframe-kit/",

13 "repository": "https://github.com/devmatt000/tailwindcss-keyframe-kit/",

14 "author": "devmatt000",

15 "license": "MIT",

16 "keywords": [

17 "tailwindcss",

18 "tailwindcss-plugin",

19 "animate.css",

20 "animation",

21 "keyframes",

22 "motion"

23 ],

24 "scripts": {

25 "lint": "eslint . --ext .js",

26 "test": "node --test"

27 },

28 "dependencies": {

29 "animate.css": "^4.1.1",

30 "postcss": "^8.4.5",

31 "@aaron205whitmore/postcss-animate-utils": "^1.0.1",

32 "postcss-js": "^3.0.3",

33 "postcss-selector-parser": "^6.0.8"

High

Suspicious Dependency Evidence

The manifest declares an unresolved runtime dependency on an animation utility package.

package.jsonView on unpkg · L31

34 },

35 "devDependencies": {

36 "eslint": "^8.5.0",

37 "eslint-config-airbnb-base": "15.0.0",

38 "eslint-plugin-import": "^2.25.2",

39 "tailwindcss": "^3.0.7"

40 },

41 "peerDependencies": {

42 "tailwindcss": "^3"

43 },

44 "engines": {

45 "node": ">=18"

46 }

47}

src/generators/motion-base.jsView file

Lines 1-35javascript

1'use strict';

3const postcss = require('postcss');

4const postcssJs = require('postcss-js');

5const

src/index.jsView file

Lines 1-22javascript

1'use strict';

3const tailwindPlugin = require('tailwindcss/plugin');

4const { loadCatalog } = require('./catalog');

5const

src/generators/index.jsView file

Lines 1-38javascript

1'use strict';

3const { buildAnimation } = require('./animations');

4const { buildMotionBase } = require('./motion-base');

5const

Source & flagged code

5 flagged · loading source

package.jsonView file

31"@aaron205whitmore/postcss-animate-utils": "^1.0.1", "postcss-js": "^3.0.3", "postcss-sele

High

Suspicious Dependency Evidence

The manifest declares an unresolved runtime dependency on an animation utility package.

package.jsonView on unpkg · L31

src/generators/motion-base.jsView file

5const postcssAnimateUtils = require('@aaron205whitmore/postcss-animate-utils'); const { VARIABLE_PREFIX } = require('./

High

Suspicious Dependency Evidence

The plugin imports that dependency and invokes it while building CSS styles.

src/generators/motion-base.jsView on unpkg · L5

29const processor = postcss([postcssAnimateUtils(toPostcssOptions(config))]); const result = processor.process('', { from: undefi

High

Suspicious Dependency Evidence

Findings

5 High2 Low

HighSuspicious Dependency Evidencepackage.json

HighSuspicious Dependency Evidencesrc/generators/motion-base.js

HighSuspicious Dependency Evidencesrc/index.js

HighSuspicious Dependency Evidencesrc/generators/index.js

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to tailwindcss-keyframe-kit@3.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing tailwindcss-keyframe-kit@3.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 10:16:17.177Z (UTC).

Source advisory published: 2026-10-19 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

3.0.2latestshownMaliciousMalwareBlockPublishedSep 28, 2026, 2:49 PM 3.0.1MaliciousMalwareBlockPublishedSep 28, 2026, 1:28 PM 3.0.0MaliciousMalwareBlockPublishedSep 28, 2026, 10:14 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code