tailwindcss-visual-kit@1.3.6
A configurable, namespaced Animate.css integration for Tailwind CSS
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18090 confirms this npm version as malicious.
Advisory
MAL-2026-18090
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tailwindcss-visual-kit (npm)
Details
tailwindcss-visual-kit (0.0.0-stage, 1.3.6) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected package code uses the unresolved runtime dependency in its style-generation path. Because its source could not be verified, the dependency behavior remains unresolved; the available source does not establish an attack.
Static reason
No blocking static signals were detected.
Trigger
Using this package’s Tailwind plugin to build styles.
Impact
The unresolved helper behavior prevents confirming whether this code path is benign; no specific harmful effect was established.
Mechanism
The plugin invokes a PostCSS helper while generating motion styles, but the helper’s source was unavailable for inspection.
AI rationale
The inspected package code uses the unresolved runtime dependency in its style-generation path. Because its source could not be verified, the dependency behavior remains unresolved; the available source does not establish an attack.
Evidence
package.jsonplugin.jssrc/motion.js
Independent scan evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
- The Tailwind plugin reaches the motion module through its style-building path.
- The motion module imports the helper and passes its result to PostCSS as a plugin; the helper’s source could not be verified.
Evidence against
- The inspected package code uses the helper while generating PostCSS styles; no attack behavior was established in the inspected code.
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
32"@jasperquinn/postcss-motion-helpers": "^1.0.1",
"postcss-js": "^3.0.3",
"postcss-selector-parser": "^6.0.8"
},
"devDependencies": {
"eslint": "^8.5.0",
"
High
Suspicious Dependency Evidence
The manifest declares @jasperquinn/postcss-motion-helpers as a runtime dependency.
package.jsonView on unpkg · L32plugin.jsView file
6const { buildStyles } = require('./src/styles');
function keyframeTailwindPlugin(options = {}) {
const config = normalizeOptions(options);
return tailwindPlugin(({ addBa
High
Ai Review Evidence
The Tailwind plugin reaches the motion module through its style-building path.
plugin.jsView on unpkg · L6src/motion.jsView file
5const postcssAnimateUtils = require('@jasperquinn/postcss-motion-helpers');
function toPostcssOptions(config) {
return {
variables: {
enabled: true,
select
Findings
4 High2 Low
HighSuspicious Dependency Evidencepackage.json
HighAi Review Evidenceplugin.js
HighAi Review Evidencesrc/motion.js
HighAi Review Evidencesrc/motion.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to tailwindcss-visual-kit@1.3.6.
See all versions of tailwindcss-visual-kit for other recorded verdicts.
- Avoid installing tailwindcss-visual-kit@1.3.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.