MalwarePublished 19 Oct 2026Updated 29 Oct 2026

animatecss-tailwind-vectrix (npm) · Malicious Code

Affects animatecss-tailwind-vectrixSource GCVE Database

Malicious package : remove animatecss-tailwind-vectrix and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18074

What to do

Remove animatecss-tailwind-vectrix from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmanimatecss-tailwind-vectrix	Affected =2.0.6 =2.0.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The animatecss-tailwind-vectrix npm package versions 2.0.6 and 2.0.7 are part of a malicious campaign involving fake job interview lures. The package depends on a private scoped package that requires an npm token to access, which can execute code when the Tailwind CSS plugin loads during development server startup. The public tarball itself contains no install scripts or network code, and the private dependency was not retrieved for analysis. Multiple related malicious packages were published under various accounts between July and October 2026.

Impact

The malicious code executes during the loading of the Tailwind CSS plugin in the development server environment if the private dependency is accessible via an npm token. This could allow attackers to run unauthorized code in the developer's environment. However, the public package itself does not contain install-time or import-time remote code execution, network communication, or credential theft mechanisms. The risk depends on the presence and access to the private dependency, which is not publicly accessible.

Defensive guidance

Since the malicious payload resides in a private dependency requiring an npm token, users should avoid using the animatecss-tailwind-vectrix package versions 2.0.6 and 2.0.7. Users should audit their dependencies for similar suspicious packages and remove or replace any packages associated with this campaign. Monitor for any updates from the package maintainers or npm security advisories regarding this threat.

Summary

The animatecss-tailwind-vectrix package versions 2.0.6 and 2.0.7 are associated with a malicious campaign that uses a private dependency requiring an npm token embedded in a lure repository to deliver payloads. The public package does not contain direct malicious code or network activity, but the private dependency executes code when the Tailwind CSS plugin is loaded in the development environment. No evidence of exfiltration, remote code execution, or backdoors was found in the public package files. The campaign includes at least 26 packages published under 17 accounts over a period of several months in 2026.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:23 UTC

Technical details

References

Community reviews