tailwind-animate-kit@2.0.6
Malicious code in tailwind-animate-kit (npm)
Analysis
tailwind-animate-kit@2.0.6 is published as a Tailwind CSS 3 plugin that reads the installed animate.css stylesheet at build time and emits namespaced animation utilities. The published tarball (14 files, ~18 KB) contains only PostCSS/Tailwind plugin source: src/index.js, src/catalog/load-catalog.js, src/options/normalize-options.js and src/css/*.js. It declares no lifecycle hooks (no preinstall/install/postinstall), no bin entries, and no network, process-spawning, dynamic-code or environment/credential access — the only filesystem access is a local read of the declared animate.css dependency. No malicious payload, C2 endpoint, or credential access was found in this version's code; the version is recorded as malicious on the basis of external reporting, so the advisory is metadata-only and consumers should treat the package name/version as untrusted pending review of the full version history.
- analyzed by
- Leitwacht
- first seen
- Oct 20, 2026, 06:24 AM
- analyzed
- Oct 20, 2026, 11:34 AM
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.