LWA-2026-13110 confirmed malware

tailwind-animate-kit@2.0.6

Malicious code in tailwind-animate-kit (npm)

Analysis

tailwind-animate-kit@2.0.6 is published as a Tailwind CSS 3 plugin that reads the installed animate.css stylesheet at build time and emits namespaced animation utilities. The published tarball (14 files, ~18 KB) contains only PostCSS/Tailwind plugin source: src/index.js, src/catalog/load-catalog.js, src/options/normalize-options.js and src/css/*.js. It declares no lifecycle hooks (no preinstall/install/postinstall), no bin entries, and no network, process-spawning, dynamic-code or environment/credential access — the only filesystem access is a local read of the declared animate.css dependency. No malicious payload, C2 endpoint, or credential access was found in this version's code; the version is recorded as malicious on the basis of external reporting, so the advisory is metadata-only and consumers should treat the package name/version as untrusted pending review of the full version history.

analyzed by
Leitwacht
first seen
Oct 20, 2026, 06:24 AM
analyzed
Oct 20, 2026, 11:34 AM

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.