Malicious Code Injection in tailwind-animationlab: A Critical Vulnerability
Summary
MAL-2026-18080: Malicious code in tailwind-animationlab (npm). Affects tailwind-animationlab versions 2.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tailwind-animationlab is a Tailwind CSS plugin designed to enhance animations within web applications. It allows developers to easily integrate animations into their projects using Tailwind's utility-first approach. However, this package has been identified as part of a malicious campaign, which compromises its integrity and poses significant risks to users.
Vulnerability Detail
The vulnerability stems from the inclusion of a private scoped package, @jasperquinn/postcss-motion-helpers, which is not publicly accessible. This package is required in the src/motion.js file and executes malicious code when the tailwind.config.js file loads the plugin. The malicious code is designed to run when the development server starts, potentially leading to unauthorized access or data breaches. The vulnerability affects versions of the package published between July 28, 2026, and October 9, 2026.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-animationlabIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the tailwind-animationlab package until a patched version is released. Alternatively, consider using other animation libraries that do not have known vulnerabilities.
Conclusion
The tailwind-animationlab package has been compromised by a malicious code injection vulnerability that poses significant risks to users. It is crucial to update the package to a patched version or consider alternative solutions to mitigate potential threats.
See every vulnerability recorded for tailwind-animationlab →
FAQ
tailwind-animationlab is a Tailwind CSS plugin that allows developers to easily add animations to their web applications.
The vulnerability can lead to the execution of malicious code, potentially compromising your application's security and data integrity.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package from your project or using an alternative animation library until a fix is available.
Detailed information about this vulnerability can be found in the vulnerability report and the package's repository on GitHub.
