Malicious Code Injection in animatecss-tailwind-luminary: A Critical Vulnerability
Summary
MAL-2026-18071: Malicious code in animatecss-tailwind-luminary (npm). Affects animatecss-tailwind-luminary versions 2.0.6 – 2.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
animatecss-tailwind-luminary is a Tailwind CSS plugin designed to integrate Animate.css animations seamlessly into Tailwind projects. It allows developers to enhance their web applications with animations while maintaining the utility-first approach of Tailwind CSS. However, this package has been compromised, exposing users to potential security risks due to malicious code embedded in a private dependency.
Vulnerability Detail
The vulnerability arises from the inclusion of a private scoped package, @jasperquinn/postcss-motion-helpers, which is not accessible on the public npm registry. This package is required in the src/motion.js file and executes malicious code when the Tailwind configuration file (tailwind.config.js) loads the plugin. The malicious code is designed to run when the development server starts, potentially compromising the security of applications that utilize this plugin. This issue is part of a larger campaign involving multiple malicious packages published under various accounts.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall animatecss-tailwind-luminaryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the animatecss-tailwind-luminary package from your project by executing 'npm uninstall animatecss-tailwind-luminary'. This will prevent any potential execution of the malicious code until a secure version is released.
Conclusion
The animatecss-tailwind-luminary package has been compromised, leading to a critical vulnerability that can execute malicious code in affected applications. It is essential to take immediate action by updating or removing the package and monitoring your project for any further vulnerabilities. Utilizing tools like Vulert can help maintain the security of your open-source dependencies.
See every vulnerability recorded for animatecss-tailwind-luminary →
FAQ
animatecss-tailwind-luminary is a Tailwind CSS plugin that integrates Animate.css animations into Tailwind projects.
The vulnerability allows malicious code to execute when the Tailwind configuration is loaded, potentially compromising your application's security.
You should uninstall the package immediately and monitor for any updates or patches that address the vulnerability.
You can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Regularly audit your dependencies and utilize tools like Vulert to stay informed about potential vulnerabilities in your open-source packages.
