Malicious Code Injection in tailwind-animatecss-kit: A Critical Vulnerability
Summary
MAL-2026-18079: Malicious code in tailwind-animatecss-kit (npm). Affects tailwind-animatecss-kit versions 2.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tailwind-animatecss-kit is a Tailwind CSS plugin designed to facilitate animations in web applications. It integrates Animate.css, providing developers with a streamlined way to enhance user interfaces with animations. However, this package has been compromised, exposing users to potential security risks due to malicious code embedded in a private dependency.
Vulnerability Detail
The vulnerability originates from the tailwind-animatecss-kit version 2.0.6, which is linked to a malicious campaign. The package requires a private scoped dependency, @jasperquinn/postcss-motion-helpers, that is not publicly accessible. This dependency is designed to execute malicious code when the Tailwind configuration file is loaded, potentially compromising the security of applications using this plugin. The malicious code is hidden within the private dependency, making it difficult for users to detect without proper scrutiny.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-animatecss-kitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of tailwind-animatecss-kit until a secure version is released. Alternatively, you can manually implement animations using Tailwind CSS without relying on this compromised package.
Conclusion
The tailwind-animatecss-kit package has been compromised, posing a significant risk to applications that utilize it. It is crucial for developers to take immediate action by updating to a secure version and monitoring their applications for vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your software.
See every vulnerability recorded for tailwind-animatecss-kit →
FAQ
tailwind-animatecss-kit is a plugin for Tailwind CSS that allows developers to easily integrate animations into their web applications.
The vulnerability can lead to the execution of malicious code, potentially compromising your application's security and exposing sensitive data.
You should uninstall the affected version and update to a patched version as soon as possible to mitigate the risk.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. Check your application for vulnerabilities using the Vulert playground.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
