Malware in npm packages.

LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.

Packages — page 2

513 packages with LPM's own review, newest scan first. Showing 49–96.

Oct 20, 2026

tailwindcss-visual-kit@1.3.6

Malware

OpenSSF Malicious Packages via OSV confirms tailwindcss-visual-kit@1.3.6 as malicious (MAL-2026-18090): Malicious code in tailwindcss-visual-kit (npm)

Oct 20, 2026

tailwind-kinetic@2.0.8

Malware

OpenSSF Malicious Packages via OSV confirms tailwind-kinetic@2.0.8 as malicious (MAL-2026-18084): Malicious code in tailwind-kinetic (npm)

Oct 20, 2026

tailwind-animate-kit@2.0.8

Malware

OpenSSF Malicious Packages via OSV confirms tailwind-animate-kit@2.0.8 as malicious (MAL-2026-18078): Malicious code in tailwind-animate-kit (npm)

Oct 20, 2026

@keruyun/agent-cli