MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animate-twcss-pack (npm) · Malicious Code

Affects animate-twcss-packSource GCVE Database

Malicious package : remove animate-twcss-pack and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18067

What to do

Remove animate-twcss-pack from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimate-twcss-pack	Affected =2.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The animate-twcss-pack version 2.0.6 is a Tailwind CSS plugin linked to a fake job interview campaign involving malicious packages. It depends on a private scoped package that is not publicly accessible, which could deliver malicious code when the plugin is loaded. However, analysis found no evidence of harmful behavior such as exfiltration, credential theft, or remote code execution in the publicly available package.

Impact

No direct harmful behavior was observed in the publicly available animate-twcss-pack 2.0.6 package. There is potential risk from the private dependency that could execute malicious code when the plugin is loaded, but this was not confirmed. No credential leakage, backdoors, or self-propagation mechanisms were detected in the analyzed package.

Defensive guidance

Since the malicious payload resides in a private dependency not publicly accessible, users should avoid installing or using animate-twcss-pack 2.0.6 and related packages from untrusted sources. Monitoring for updates from trusted vendors or repositories is recommended.

Summary

animate-twcss-pack 2.0.6 is associated with a malicious campaign distributing fake Tailwind CSS plugins. The package requires a private dependency that is inaccessible publicly and may contain the actual payload. The publicly published tarball does not include install scripts or network code, and no malicious activity was observed during installation or runtime in the public package. Multiple related packages were published under various accounts over a period of months. The threat lies primarily in the private dependency, which was not retrieved for analysis.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:54 UTC

Technical details

References

Community reviews