MalwarePublished 11 Jun 2026Updated 7 Jul 2026

tailwind-animator-scroll (npm) · Malicious Code

Affects tailwind-animator-scrollSource GCVE Database

Malicious package : remove tailwind-animator-scroll and rotate any secrets on hosts that installed it.

Data as of 8 Jul 2026, 13:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5618

What to do

Remove tailwind-animator-scroll from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwind-animator-scroll	Affected =1.7.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tailwind-animator-scroll version 1.7.0 contains malicious code embedded in its main entry point. The code uses obfuscated eval and base64 decoding to execute attacker-controlled payloads during the build process, exposing sensitive environment variables, CI tokens, source code, and credentials. The package impersonates a legitimate Tailwind CSS animation plugin via typosquatting and copied documentation to lure developers into installing it. Installation or use of this package compromises the host system, potentially allowing full attacker control.

Impact

Systems with tailwind-animator-scroll version 1.7.0 installed or running are fully compromised. Attacker-controlled code executes in the build environment, exposing sensitive secrets, environment variables, source code, and credentials. This can lead to unauthorized access, data theft, and further system compromise. Because the malicious code executes during build, continuous integration environments and developer machines are at risk. The compromise may persist beyond package removal due to potential attacker persistence mechanisms.

Defensive guidance

The package should be immediately removed from all environments. All secrets, keys, and credentials exposed on compromised systems must be rotated from a secure, uncompromised machine. Developers should verify the authenticity of npm packages before installation, avoiding typosquatted or suspicious packages. Monitor for any unusual activity indicating persistent compromise.

Summary

The tailwind-animator-scroll npm package (version 1.7.0) includes obfuscated malicious code in its src/index.js file. This code uses eval with base64-decoded payloads to re-expose Node.js require and module as global aliases and then executes a further opaque payload via a custom decoder and Function constructor. Because this code runs in the main entry point, simply adding the plugin to tailwind.config.js triggers execution within the developer's build environment, exposing sensitive data such as CI tokens, environment variables, source code, and credentials. The package also impersonates the legitimate tailwindcss-animationfound plugin by copying its CSS classes and API, using a misspelled package name (typosquatting), and linking to the real plugin to deceive users. Removal of the package alone may not fully remediate the compromise as the attacker may have established persistent control.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2026, 13:45 UTC

Technical details

References

Community reviews