MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animate-tailwind-kit (npm) · Malicious Code

Affects animate-tailwind-kitSource GCVE Database

Malicious package : remove animate-tailwind-kit and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18065

What to do

Remove animate-tailwind-kit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimate-tailwind-kit	Affected =3.0.1 =3.0.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The animate-tailwind-kit npm package versions 3.0.1 and 3.0.4 are linked to a malicious campaign involving a private dependency that delivers malicious code when the plugin is loaded in Tailwind CSS configurations. The public package itself contains no installer scripts or network code, but it requires a private scoped package that is not publicly accessible and relies on an npm token committed in a lure repository. This private dependency executes code during development server startup. Multiple related malicious packages were published over several months under various accounts.

Impact

The malicious payload is delivered via a private dependency that executes code during the loading of the Tailwind CSS plugin and development server startup. This can lead to execution of unauthorized code in the development environment of users who install and use the affected package versions. However, the public package itself does not perform installer-facing malicious actions or network communications. There is no evidence of credential theft or data exfiltration from the public package alone.

Defensive guidance

Users should avoid installing or using animate-tailwind-kit versions 3.0.1 and 3.0.4 due to their association with a malicious private dependency. Since the malicious payload resides in a private scoped package requiring an npm token, verifying and removing any such tokens from repositories is critical. Monitor for updates from the package maintainers or npm advisories for further guidance.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:54 UTC

Technical details

References

Community reviews