The npm package 'mxckjdgweuxpsiohd' contains a malicious HTML file impersonating a Cloudflare Turnstile challenge page with heavily obfuscated scripts. The package does not execute code during installation or require(), but opening the HTML in a browser could expose users to phishing or malicious activity. The package has no legitimate functionality and appears designed solely to distribute this phishing-like content. Any system with this package installed should be considered compromised, and all secrets and keys on that system should be rotated immediately.
The npm package mx3dxhgic8xhd6 version 1.0.1 is a malicious package containing heavily obfuscated JavaScript code embedded in an HTML file. The code uses complex string and control-flow obfuscation techniques to hide its runtime behavior, which cannot be determined without execution or de-obfuscation. The package is consistent with phishing or click-fraud delivery mechanisms rather than a legitimate library. Installation of this package may fully compromise the affected computer, risking exposure of all stored secrets and keys.
The zeroz-baileys@1.0.1 package is a fork of the Baileys WhatsApp library that contains suspicious code patterns involving child process execution and HTTPS requests. While no direct evidence of installer-side malicious behavior or attacker-controlled destinations was confirmed, the package is considered malicious by a security source. Any system with this package installed should be treated as fully compromised, and all stored secrets and keys should be rotated immediately. Removal of the package alone may not eliminate all malicious components.
The xzbails npm package, versions 0.0.3, 0.0.4, and 0.0.5, is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package xzvexpzcbailey is part of a large family of malicious forks of the Baileys WhatsApp Web library. These packages inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious behavior abuses the installer's own WhatsApp session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @ostyado/baileys versions 2.0.6 through 2.0.9 contains malicious code that silently subscribes the user's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection, using the victim's own session. The targeted channels are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, establish persistence, or execute arbitrary code.
The tailwindcss-keyframe-kit npm package versions 3.0.0, 3.0.1, and 3.0.2 is identified as malicious. It is part of a fake job interview campaign and includes a private dependency that executes code when the plugin is loaded, potentially compromising the host system. Although the public package tarball shows no install-time or network malicious behavior, the private dependency payload is not publicly accessible and may deliver harmful code. Systems with this package installed should be considered fully compromised.
The tailwindcss-animate-catalog npm package versions 2.0.6 and 2.0.7 are part of a malicious campaign involving fake job interview lures. The package itself appears benign with no direct malicious code in its public tarball, but it depends on a private scoped package that requires an npm token embedded in the lure repository. This private dependency likely delivers the malicious payload when the plugin is loaded during development. Installing or running this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
The npm package tailwind-kinetic versions 2.0.6 and 2.0.8 are part of a malicious campaign linked to fake job interviews. The package itself contains no direct install scripts or network code, but it depends on a private scoped package that requires an npm token embedded in a lure repository. This private dependency executes code when the plugin is loaded, potentially compromising the host system. Multiple related malicious packages were published over several months. Although the shipped package content does not show typical supply-chain attack fingerprints, any system with this package installed should be considered fully compromised.
The npm package tailwind-keyframes version 2.0.6 is associated with a malicious campaign involving a private dependency that delivers malicious code when the plugin is loaded. Although the public package tarball contains no install scripts or network code, the payload resides in a private scoped package that requires an npm token to access. This package is part of a broader campaign with multiple malicious packages published under various accounts between July and October 2026. Installing or running this package may lead to full system compromise.
The tailwind-animationlab package version 2.0.6 is a malicious npm package linked to a fake job interview campaign. It includes a private scoped dependency that requires an npm token to access, which delivers malicious code executed when the plugin loads in tailwind.config.js and the development server starts. Although the published package itself contains no install scripts or network code, the private dependency payload compromises the system. Multiple related malicious packages were published over a period from July to October 2026. Systems with this package installed should be considered fully compromised.
The tailwind-animate-kit npm package versions 2.0.6, 2.0.7, and 2.0.8 are part of a malicious campaign involving a private dependency that executes code when the plugin is loaded in tailwind.config.js. The malicious payload is hidden in a private scoped package that requires an npm token to resolve, enabling code execution during development server startup. The package tarballs themselves contain no install scripts or network code, making detection difficult. This campaign includes multiple malicious packages published under various accounts between July and October 2026. Systems with this package installed should be considered fully compromised.
The tailwindcss-visual-kit npm package versions 0.0.0-stage and 1.3.6 are associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded. The malicious payload resides in a private scoped package that requires an npm token to access and is not present in the public registry. The publicly available package tarball contains no install scripts or network code, and no direct supply-chain attack behavior was observed in the analyzed package contents. Multiple related packages were published under various accounts over several months.
The npm package tailwindcss-motionanimate version 1.0.1 is identified as malicious. It is part of a fake job interview campaign involving multiple similar packages. The package itself contains no install-time execution, no lifecycle scripts, no network communication, and no observable malicious behavior in the published tarball. The malicious payload is hidden in a private scoped dependency that requires an npm token to access, which was not retrieved during analysis. Multiple related packages were published over a period of months by various accounts.
The npm package tailwindcss-effect-lab versions 0.0.0-stage and 1.6.7 is associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded. The payload resides in a private scoped package that requires an npm token to access, preventing public retrieval of the malicious code. The publicly available tarball does not contain install scripts or network code. Multiple related packages were published under different accounts over several months. An Amazon Inspector analysis found no evidence of typical supply-chain attack behaviors such as network activity or credential theft in the examined package.
The npm package tailwindcss-animatemotion version 1.0.7 is associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded in tailwind.config.js. The malicious payload resides in a private scoped package that requires an npm token to resolve, preventing public retrieval. The published package itself contains no install scripts or network code, and no direct malicious behavior was observed in the shipped files. Multiple related packages were published under various accounts over a period of months.
The tailwind-css-keyframes package version 1.0.7 is identified as malicious, associated with a fake job interview campaign. It includes a private scoped dependency that requires an npm token to access, which can execute code when the plugin is loaded in tailwind.config.js and the development server starts. The public tarball itself contains no install scripts or network code, and the malicious payload resides in the private dependency. Multiple related malicious packages were published over a period from July to October 2026. No install-time or import-time network activity, credential access, or obfuscated payloads were observed in the public package.
The npm package tailwind-animatecss-kit version 2.0.6 is associated with a malicious campaign involving fake job interviews. It includes a private scoped dependency that requires an npm token to resolve, enabling code execution when the plugin is loaded in tailwind.config.js and the development server starts. The public tarball itself contains no install scripts or network code, and no direct harmful code paths were identified in the shipped contents. Multiple similar packages were published under various accounts during mid-2026.
The npm package tailwind-animaflow-kit version 2.0.6 is associated with a malicious campaign involving fake job interview lures. The package itself contains no install scripts or network code, but it requires a private scoped dependency that is inaccessible publicly and delivers the malicious payload when the plugin is loaded in tailwind.config.js. Multiple similar packages were published under different accounts over a short period in 2026.
The npm package animatecss-tailwind-luminary versions 2.0.6 and 2.0.7 is associated with a malicious campaign involving multiple fake packages. The package itself contains no harmful install-time or import-time behavior, no lifecycle scripts, and no network calls. However, it depends on a private scoped package that is not publicly accessible and requires an npm token, which could deliver malicious code when the plugin is loaded in a development environment. This campaign includes multiple packages published under various accounts over a period of months.