tailwind-animaflow-kit (npm) · Malicious Code
Affects tailwind-animaflow-kitSource GCVE Database
Malicious package : remove tailwind-animaflow-kit and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 17:54 UTC
Malicious package
Published to npm · OSV MAL-2026-18077
What to do
Remove tailwind-animaflow-kit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmtailwind-animaflow-kit | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package tailwind-animaflow-kit version 2.0.6 is associated with a malicious campaign involving fake job interview lures. The package itself contains no install scripts or network code, but it requires a private scoped dependency that is inaccessible publicly and delivers the malicious payload when the plugin is loaded in tailwind.config.js. Multiple similar packages were published under different accounts over a short period in 2026.
References
- osv.dev/vulnerability/MAL-2026-17665 (opens in a new tab)
- osv.dev/vulnerability/MAL-2026-17666 (opens in a new tab)
- osv.dev/vulnerability/MAL-2026-17667 (opens in a new tab)
- pkgwarden.com/incidents/fake-interview-tailwind-plugins-npm-october-2026/ (opens in a new tab)
- npmjs.com/package/tailwind-animaflow-kit/v/2.0.6 (opens in a new tab)