The tailwind-animator-scroll npm package (version 1.7.0) includes obfuscated malicious code in its src/index.js file. This code uses eval with base64-decoded payloads to re-expose Node.js require and module as global aliases and then executes a further opaque payload via a custom decoder and Function constructor. Because this code runs in the main entry point, simply adding the plugin to tailwind.config.js triggers execution within the developer's build environment, exposing sensitive data such as CI tokens, environment variables, source code, and credentials. The package also impersonates the legitimate tailwindcss-animationfound plugin by copying its CSS classes and API, using a misspelled package name (typosquatting), and linking to the real plugin to deceive users. Removal of the package alone may not fully remediate the compromise as the attacker may have established persistent control.

Systems with tailwind-animator-scroll version 1.7.0 installed or running are fully compromised. Attacker-controlled code executes in the build environment, exposing sensitive secrets, environment variables, source code, and credentials. This can lead to unauthorized access, data theft, and further system compromise. Because the malicious code executes during build, continuous integration environments and developer machines are at risk. The compromise may persist beyond package removal due to potential attacker persistence mechanisms.

No official patch or fix is currently available for this malicious package. The package should be immediately removed from all environments. All secrets, keys, and credentials exposed on compromised systems must be rotated from a secure, uncompromised machine. Developers should verify the authenticity of npm packages before installation, avoiding typosquatted or suspicious packages. Monitor for any unusual activity indicating persistent compromise. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.