MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animate-twcss-bridge (npm) · Malicious Code

Affects animate-twcss-bridgeSource GCVE Database

Malicious package : remove animate-twcss-bridge and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18066

What to do

Remove animate-twcss-bridge from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimate-twcss-bridge	Affected =2.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package animate-twcss-bridge version 2.0.6 is identified as malicious and linked to a fake job interview campaign. It depends on a private scoped package that requires an npm token to resolve, which can execute code when the Tailwind CSS plugin loads. The publicly available tarball does not contain install scripts or network code, and the malicious payload resides in the private dependency. Multiple related malicious packages were published under various accounts over a period of months. No direct lifecycle script execution or network communication is present in the shipped contents.

Impact

The malicious code executes when the Tailwind CSS plugin is loaded and the development server starts, potentially allowing unauthorized code execution in the development environment. However, the payload is contained within a private dependency requiring an npm token, limiting exposure to users who have access to that token. There is no evidence of network communication, credential theft, or persistence mechanisms in the public package contents.

Defensive guidance

Users should avoid using animate-twcss-bridge version 2.0.6 and related packages published by the same campaign. Monitor for any updates or advisories from npm or package maintainers regarding this threat. No direct remediation is available as the malicious payload resides in a private dependency requiring a token.

Summary

animate-twcss-bridge (2.0.6) is a Tailwind CSS plugin involved in a malicious campaign masquerading as a legitimate Animate.css integration. The package requires a private dependency (@aaron205whitmore/postcss-animate-utils) that is inaccessible publicly and resolves only with a committed npm token, enabling execution of malicious code during plugin initialization. The public package tarball itself lacks install scripts, network communication, or obvious persistence mechanisms. The campaign includes at least 26 similar packages published under multiple accounts between July and October 2026. The shipped code does not exhibit typical malicious behaviors such as environment scraping or direct communication with attacker infrastructure.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:54 UTC

Technical details

References

Community reviews