MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animatecss-tailwind-graphic (npm) · Malicious Code

Affects animatecss-tailwind-graphicSource GCVE Database

Malicious package : remove animatecss-tailwind-graphic and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18069

What to do

Remove animatecss-tailwind-graphic from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimatecss-tailwind-graphic	Affected =2.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package animatecss-tailwind-graphic version 2.0.6 is linked to a malicious campaign involving fake job interviews. It depends on a private scoped package that is not publicly accessible and requires an npm token found in a lure repository, enabling execution of hidden code when the plugin is loaded in Tailwind CSS. The public tarball itself contains no install scripts or network code, and no direct harmful behavior was observed in the shipped package contents. Multiple similar packages were published under various accounts over a period of months.

Impact

The package itself does not exhibit direct malicious behavior in its public form; however, it is part of a supply chain attack where the actual malicious payload is delivered via a private dependency accessible only with a specific npm token. This can lead to execution of unauthorized code when the plugin is loaded in development environments, potentially compromising developer systems or build processes.

Defensive guidance

Users should avoid using animatecss-tailwind-graphic version 2.0.6 and related packages from the identified campaign. Verify dependencies and avoid installing packages that require private scoped dependencies with unknown access tokens. Monitor for updates or advisories from npm or security vendors regarding these packages.

Summary

animatecss-tailwind-graphic (2.0.6) is a Tailwind CSS plugin associated with a malicious campaign (MAL-2026-17665 and MAL-2026-17666) that uses a private dependency requiring a committed npm token to execute hidden code during plugin loading. The public package does not contain install-time or import-time malicious behavior, network calls, or persistence mechanisms. The payload resides in a private scoped package that was not retrieved for analysis. Twenty-six related packages were published under seventeen accounts between July and October 2026.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:54 UTC

Technical details

References

Community reviews