MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animatecss-tailwind-binary (npm) · Malicious Code

Affects animatecss-tailwind-binarySource GCVE Database

Malicious package : remove animatecss-tailwind-binary and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18068

What to do

Remove animatecss-tailwind-binary from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimatecss-tailwind-binary	Affected =2.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package animatecss-tailwind-binary version 2.0.6 is part of a malicious campaign involving fake job interview lures. The package itself contains no install scripts or network code, but it depends on a private scoped package that requires an npm token to access. This private dependency, which was not retrieved during analysis, contains the malicious payload that executes when the Tailwind CSS plugin loads during development server startup. Multiple related malicious packages were published under various accounts over a period from July to October 2026.

Impact

The malicious code is delivered through a private dependency that requires an npm token, which means the payload executes only if the token is present and the plugin is loaded. This can lead to execution of unauthorized code during development server startup. The public package itself does not contain direct harmful code or network activity. The threat is part of a broader campaign involving multiple malicious packages, potentially targeting developers who inadvertently commit npm tokens or use these packages.

Defensive guidance

Since the malicious payload resides in a private dependency requiring an npm token, avoid using animatecss-tailwind-binary@2.0.6 and related packages from untrusted sources. Do not commit npm tokens or credentials in repositories. Review and audit dependencies for private or unknown packages.

Summary

animatecss-tailwind-binary@2.0.6 is a Tailwind CSS plugin linked to a fake job interview campaign. The package's public tarball does not include lifecycle scripts or network activity indicative of installer-side harm. However, it requires a private scoped package (@jasperquinn/postcss-motion-helpers) that is inaccessible publicly and resolves only with a committed npm token. The malicious payload resides in this private dependency and executes when the plugin is loaded via tailwind.config.js and the development server starts. Twenty-six similar packages were published across seventeen accounts between 2026-07-28 and 2026-10-09. Analysis found no direct exfiltration, remote code fetching, backdoors, or self-propagation in the public package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:54 UTC

Technical details

References

Community reviews