MalwarePublished 19 Oct 2026Updated 29 Oct 2026

tailwindcss-motionanimate (npm) · Malicious Code

Affects tailwindcss-motionanimateSource GCVE Database

Malicious package : remove tailwindcss-motionanimate and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18089

What to do

Remove tailwindcss-motionanimate from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtailwindcss-motionanimate	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tailwindcss-motionanimate version 1.0.1 is identified as malicious. It is part of a fake job interview campaign involving multiple similar packages. The package itself contains no install-time execution, no lifecycle scripts, no network communication, and no observable malicious behavior in the published tarball. The malicious payload is hidden in a private scoped dependency that requires an npm token to access, which was not retrieved during analysis. Multiple related packages were published over a period of months by various accounts.

Impact

No direct malicious behavior was observed in the public package itself. The potential impact depends on the private dependency, which was not retrieved and analyzed. If the private dependency executes malicious code when the plugin is loaded, it could lead to code execution or other malicious activity during development server startup. However, without access to the private dependency, the exact impact is unknown.

Defensive guidance

Since the malicious payload is in a private dependency requiring an npm token, avoid using tailwindcss-motionanimate@1.0.1 and related packages from suspicious or untrusted sources. Users should remove this package from their projects and audit dependencies for similar malicious packages. No direct remediation is available for the private dependency as it is inaccessible publicly.

Summary

tailwindcss-motionanimate@1.0.1 is a Tailwind CSS plugin linked to a fake job interview campaign. The package requires a private scoped dependency (@jasperquinn/postcss-motion-helpers) that is inaccessible publicly and only resolves with a committed npm token in the lure repository. The malicious payload resides in this private dependency, not in the public package tarball. The public package shows no install-time execution, no lifecycle scripts fetching remote code, no credential or environment reads, and no network communication. Twenty-six similar packages under seventeen accounts were published between July and October 2026.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:53 UTC

Technical details

References

Community reviews