tailwindcss-keyframe-kit@3.0.1
Tailwind CSS 3 plugin that emits only the Animate.css animations you select, with namespaced keyframes
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18088 confirms this npm version as malicious.
Advisory
MAL-2026-18088
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwindcss-keyframe-kit (npm)
Details
tailwindcss-keyframe-kit (3.0.0, 3.0.1, 3.0.2) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. src/generators/motion-base.js:5 requires the private scoped package @aaron205whitmore/postcss-animate-utils, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected entrypoint and generator show ordinary Tailwind style generation, with no confirmed attack behavior. Because an imported runtime dependency is unresolved and its implementation was unavailable for review, the package requires manual review.
Static reason
No blocking static signals were detected.
Trigger
Using the Tailwind plugin invokes the style generation path that calls the unresolved dependency.
Impact
The dependency's behavior and resulting impact remain unknown, so a clean verdict is not supported.
Mechanism
The dependency receives configuration for generating PostCSS output; its implementation could not be inspected.
AI rationale
The inspected entrypoint and generator show ordinary Tailwind style generation, with no confirmed attack behavior. Because an imported runtime dependency is unresolved and its implementation was unavailable for review, the package requires manual review.
Evidence
package.jsonsrc/generators/motion-base.jssrc/index.js
Independent scan evidence
public snapshotAI called this Manual Review at 85.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares @aaron205whitmore/postcss-animate-utils as a runtime dependency.
- src/generators/motion-base.js imports that dependency and invokes it while building styles.
- The supplied snapshot could not resolve that dependency's registry source, so its behavior remains unverified.
Evidence against
- The entrypoint exposes a Tailwind plugin that builds styles and passes them to addBase and addUtilities.
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
28"dependencies": {
"animate.css": "^4.1.1",
"postcss": "^8.4.5",
"@aaron205whitmore/postcss-animate-utils": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
"eslint-config-airbnb-base": "15.0.0",
"eslint-plugin-import": "^2.25.2",
"tailwindcss": "^3.0.7"
},
High
Suspicious Dependency Evidence
package.json declares @aaron205whitmore/postcss-animate-utils as a runtime dependency.
package.jsonView on unpkg · L28src/generators/motion-base.jsView file
3const postcss = require('postcss');
const postcssJs = require('postcss-js');
const postcssAnimateUtils = require('@aaron205whitmore/postcss-animate-utils');
const { VARIABLE_PREFIX } = require('./variables');
function toPostcssOptions(config) {
return {
variables: {
enabled: tru
High
Suspicious Dependency Evidence
src/generators/motion-base.js imports that dependency and invokes it while building styles.
src/generators/motion-base.jsView on unpkg · L3Findings
4 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencesrc/generators/motion-base.js
HighSuspicious Dependency Evidencesrc/generators/motion-base.js
HighSuspicious Dependency Evidencesrc/index.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to tailwindcss-keyframe-kit@3.0.1.
See all versions of tailwindcss-keyframe-kit for other recorded verdicts.
- Avoid installing tailwindcss-keyframe-kit@3.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.