MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animatecss-tailwind-luminary (npm) · Malicious Code

Affects animatecss-tailwind-luminarySource GCVE Database

Malicious package : remove animatecss-tailwind-luminary and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18071

What to do

Remove animatecss-tailwind-luminary from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimatecss-tailwind-luminary	Affected =2.0.6 =2.0.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package animatecss-tailwind-luminary versions 2.0.6 and 2.0.7 is associated with a malicious campaign involving multiple fake packages. The package itself contains no harmful install-time or import-time behavior, no lifecycle scripts, and no network calls. However, it depends on a private scoped package that is not publicly accessible and requires an npm token, which could deliver malicious code when the plugin is loaded in a development environment. This campaign includes multiple packages published under various accounts over a period of months.

Impact

While the publicly available package does not exhibit direct malicious behavior, the reliance on a private dependency that requires an npm token suggests potential for executing malicious code in environments where the token is present. This could lead to code execution during development server startup when the plugin is loaded. No known exploits in the wild have been reported.

Defensive guidance

Avoid using animatecss-tailwind-luminary versions 2.0.6 and 2.0.7, especially in environments where private npm tokens are accessible. Since no official patches or advisories are provided, the best mitigation is to remove or replace this package with a trusted alternative. Monitor for updates from the vendor or npm security advisories regarding this package.

Summary

animatecss-tailwind-luminary (versions 2.0.6 and 2.0.7) is a Tailwind CSS plugin linked to a malicious campaign involving fake packages. The package requires a private dependency (@jasperquinn/postcss-motion-helpers) that is inaccessible publicly and resolves only with a committed npm token, potentially delivering malicious payloads during plugin initialization. The publicly available tarball shows no direct malicious behavior such as install scripts, network calls, or credential harvesting. The campaign includes at least 26 packages published under 17 accounts between July and October 2026.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:54 UTC

Technical details

References

Community reviews