MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animatecss-tailwind-presets (npm) · Malicious Code

Affects animatecss-tailwind-presetsSource GCVE Database

Malicious package : remove animatecss-tailwind-presets and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18073

What to do

Remove animatecss-tailwind-presets from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimatecss-tailwind-presets	Affected =1.0.0 =2.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The animatecss-tailwind-presets npm package versions 1.0.0 and 2.0.3 are linked to a malicious campaign involving a private dependency that delivers malicious code when the plugin is loaded in Tailwind CSS configurations. The public package itself contains no direct installer-facing malicious behavior, but it requires a private scoped package that is not publicly accessible and contains the actual payload. Multiple related packages were published under different accounts over a period of several months.

Impact

The malicious payload is delivered through a private dependency that is triggered during the loading of the Tailwind CSS plugin, potentially allowing execution of unauthorized code in development environments that use this package and have access to the private dependency. The public package itself does not exhibit direct malicious behavior, but the dependency chain enables the attack. There is no evidence of exploitation in the wild as of the published date.

Defensive guidance

Since the malicious payload resides in a private dependency requiring an npm token, users should avoid using the animatecss-tailwind-presets package versions 1.0.0 and 2.0.3, especially if they do not control or trust the private dependencies. Review and remove any usage of these packages and related suspicious packages published under multiple accounts. Monitor for vendor advisories or updates for remediation guidance.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:23 UTC

Technical details

References

Community reviews