MalwarePublished 19 Oct 2026Updated 29 Oct 2026

tailwind-keyframes (npm) · Malicious Code

Affects tailwind-keyframesSource GCVE Database

Malicious package : remove tailwind-keyframes and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18083

What to do

Remove tailwind-keyframes from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwind-keyframes	Affected =2.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tailwind-keyframes version 2.0.6 is associated with a malicious campaign involving a private dependency that delivers malicious code when the plugin is loaded. Although the public package tarball contains no install scripts or network code, the payload resides in a private scoped package that requires an npm token to access. This package is part of a broader campaign with multiple malicious packages published under various accounts between July and October 2026. Installing or running this package may lead to full system compromise.

Impact

Any system that installs or runs tailwind-keyframes@2.0.6 should be considered fully compromised. The malicious payload delivered via the private dependency can lead to complete control over the affected computer. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted machine. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by the attack.

Defensive guidance

Remove the tailwind-keyframes@2.0.6 package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or accessible on the compromised machines using a separate, secure environment. Because the malicious payload is delivered via a private dependency, simply uninstalling the package may not fully remediate the compromise. Conduct a thorough incident response to identify and remove any persistent backdoors or malware introduced. Monitor for any related malicious packages and avoid installing packages from untrusted or suspicious sources.

Summary

tailwind-keyframes@2.0.6 is a Tailwind CSS plugin linked to a malicious campaign that uses a private scoped dependency (@aaron205whitmore/postcss-animate-utils) accessible only with a committed npm token. The public package itself shows no direct malicious behavior in its files, but the private dependency delivers the malicious payload when the plugin is loaded via tailwind.config.js and the development server starts. This package is one of many published in a coordinated campaign between 2026-07-28 and 2026-10-09. Security scans of the public package found no direct indicators of compromise, but the private dependency and the campaign context indicate a supply chain attack vector.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:52 UTC

Technical details

References

Community reviews