MalwarePublished 19 Oct 2026Updated 29 Oct 2026

tailwindcss-animate-catalog (npm) · Malicious Code

Affects tailwindcss-animate-catalogSource GCVE Database

Malicious package : remove tailwindcss-animate-catalog and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18085

What to do

Remove tailwindcss-animate-catalog from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwindcss-animate-catalog	Affected =2.0.6 =2.0.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The tailwindcss-animate-catalog npm package versions 2.0.6 and 2.0.7 are part of a malicious campaign involving fake job interview lures. The package itself appears benign with no direct malicious code in its public tarball, but it depends on a private scoped package that requires an npm token embedded in the lure repository. This private dependency likely delivers the malicious payload when the plugin is loaded during development. Installing or running this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Any system with this package installed or running is considered fully compromised. Attackers may have gained full control, potentially accessing all secrets and keys stored on the system. Immediate secret and key rotation from a separate, uncompromised system is required. Removing the package alone does not guarantee removal of all malicious software introduced by the compromise.

Defensive guidance

Remove the tailwindcss-animate-catalog package versions 2.0.6 and 2.0.7 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a secure, separate environment. Due to the likelihood of full system compromise, conduct a thorough incident response and system remediation.

Summary

tailwindcss-animate-catalog versions 2.0.6 and 2.0.7 are malicious npm packages linked to a fake job interview campaign. The publicly available tarball contains no install scripts or network code, but it requires a private scoped package (@jasperquinn/postcss-motion-helpers) accessible only with a committed npm token. This private dependency executes malicious code when the Tailwind CSS plugin is loaded in tailwind.config.js and the development server starts. Although the public package appears clean, the private dependency likely delivers the payload. Multiple similar packages were published under various accounts over several months. The package should be considered fully compromising any system where it is installed or run.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:52 UTC

Technical details

References

Community reviews