Malicious Code Vulnerability in tailwind-animatecss-uniform Package
Summary
MAL-2026-17667: Malicious code in tailwind-animatecss-uniform (npm). Affects tailwind-animatecss-uniform versions 2.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tailwind-animatecss-uniform package, version 2.0.7, is an npm package designed to integrate Animate.css with Tailwind CSS, providing developers with a configurable and namespaced animation solution. However, it has been identified as part of a malicious campaign targeting developers through fake job interviews, where it exploits a committed npm auth token to execute unauthorized code.
Vulnerability Detail
The vulnerability originates from the tailwind-animatecss-uniform package being part of a deceptive job interview scheme. It includes a runtime dependency on a private npm package that is not publicly accessible, allowing it to execute malicious code when the Tailwind configuration is loaded. This code can contact an operator-controlled server and run with full Node.js privileges, posing significant security risks to developers who inadvertently use this package in their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-animatecss-uniformIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tailwind-animatecss-uniform package and consider alternative packages for integrating Animate.css with Tailwind CSS. Additionally, ensure that your project does not include any .npmrc files with plaintext npm auth tokens.
Conclusion
The tailwind-animatecss-uniform package has been identified as a vector for malicious code execution due to its integration with a private npm package. Developers are advised to remove this package from their projects and monitor their dependencies for vulnerabilities to ensure the security of their applications.
See every vulnerability recorded for tailwind-animatecss-uniform →
FAQ
It is an npm package that integrates Animate.css with Tailwind CSS, allowing developers to use animations in their projects.
The vulnerability allows malicious code to run with full Node.js privileges, potentially compromising your project's security and exposing sensitive information.
Remove the package from your project immediately and check for any unauthorized access or changes in your environment.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
