The tailwind-animate-v4 package, distributed via npm, masquerades as the legitimate tailwindcss-animate plugin by copying its source code and author metadata. However, it appends a large obfuscated loader hidden in whitespace at the end of the index.js file. Upon requiring the package, this loader decodes and executes a large opaque payload using the Function constructor, granting it full access to the runtime environment including environment variables, filesystem, and network. This dynamic execution occurs during the developer or build process, enabling potentially malicious actions under the guise of a trusted dependency. The affected versions are exactly 1.1.0, 2.1.0, 2.1.1, and 2.1.2.

Any project that installs and requires tailwind-animate-v4 versions 1.1.0, 2.1.0, 2.1.1, or 2.1.2 will execute the hidden malicious payload. This execution occurs with the privileges of the build or developer environment, allowing the attacker to access sensitive environment variables, read or modify the filesystem, and perform network operations. This can lead to data theft, environment compromise, or further malware deployment.

No official patch or fix is currently available. Users should immediately remove the tailwind-animate-v4 package from their projects and replace it with the legitimate tailwindcss-animate package. Avoid installing or requiring tailwind-animate-v4 in any environment. Review build and development environments for signs of compromise if this package was previously used.