MalwarePublished 19 Oct 2026Updated 29 Oct 2026

tailwind-kinetic (npm) · Malicious Code

Affects tailwind-kineticSource GCVE Database

Malicious package : remove tailwind-kinetic and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18084

What to do

Remove tailwind-kinetic from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwind-kinetic	Affected =2.0.6 =2.0.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tailwind-kinetic versions 2.0.6 and 2.0.8 are part of a malicious campaign linked to fake job interviews. The package itself contains no direct install scripts or network code, but it depends on a private scoped package that requires an npm token embedded in a lure repository. This private dependency executes code when the plugin is loaded, potentially compromising the host system. Multiple related malicious packages were published over several months. Although the shipped package content does not show typical supply-chain attack fingerprints, any system with this package installed should be considered fully compromised.

Impact

Any computer with tailwind-kinetic versions 2.0.6 or 2.0.8 installed or running is considered fully compromised. The malicious payload is delivered via a private dependency that executes code during plugin loading, potentially granting attackers control over the system. All secrets and keys stored on the compromised computer should be rotated immediately from a separate, clean device. Removing the package alone does not guarantee removal of all malicious software resulting from the compromise.

Defensive guidance

Remove the tailwind-kinetic package versions 2.0.6 and 2.0.8 immediately from all affected systems. Rotate all secrets and keys that may have been exposed, using a different, uncompromised computer. Since the private dependency payload was not retrieved and the system is considered fully compromised, a full system investigation and potential rebuild is recommended.

Summary

tailwind-kinetic versions 2.0.6 and 2.0.8 are malicious Tailwind CSS plugins associated with a fake job interview campaign. The package requires a private scoped dependency (@aaron205whitmore/postcss-animate-utils) which is not publicly accessible and resolves only with an npm token committed in a lure repository. This private dependency executes code upon loading the plugin in tailwind.config.js and starting the development server. The publicly published tarball contains no install scripts or network code, and no direct exfiltration or backdoor mechanisms were found in the inspected files. However, the private dependency payload was not retrieved and is the likely source of malicious activity. Twenty-six related packages under seventeen accounts were published between July and October 2026. The presence of this package on a system indicates a full compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:52 UTC

Technical details

References

Community reviews