Malicious Code Injection in tailwind-keyframes: A Critical Vulnerability
Summary
MAL-2026-18083: Malicious code in tailwind-keyframes (npm). Affects tailwind-keyframes versions 2.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tailwind-keyframes is a Tailwind CSS plugin designed to facilitate the integration of animations into web projects. It allows developers to easily implement keyframe animations using Tailwind's utility-first approach. However, this package has been compromised, leading to significant security concerns due to the inclusion of malicious code that exploits private dependencies.
Vulnerability Detail
The vulnerability originates from the malicious code embedded in the tailwind-keyframes package version 2.0.6, which is linked to a broader campaign involving fake job interviews. The package requires a private scoped dependency, @aaron205whitmore/postcss-animate-utils, which is not publicly accessible. This dependency contains code that executes when the Tailwind configuration file is loaded, potentially allowing attackers to run arbitrary code on the user's system. The implications of this vulnerability are severe, as it can lead to unauthorized access and manipulation of the user's environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-keyframesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the tailwind-keyframes package from your project until a secure version is released. To do this, run: 'npm uninstall tailwind-keyframes'. Additionally, consider using alternative animation libraries that do not have known vulnerabilities.
Conclusion
The tailwind-keyframes package has been compromised, leading to a critical vulnerability that can execute malicious code on affected systems. It is crucial to update or remove the package to protect your project. Utilizing tools like Vulert can help you stay informed about vulnerabilities in your dependencies.
See every vulnerability recorded for tailwind-keyframes →
FAQ
tailwind-keyframes is a plugin for Tailwind CSS that allows developers to implement keyframe animations easily.
The vulnerability can allow malicious code to execute on your system, potentially compromising your project's security and integrity.
Check the npm registry for the latest version of tailwind-keyframes. If a patched version is available, updating the package will resolve the issue.
Consider removing the package from your project as a temporary measure and look for alternative solutions for animations.
You can use Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities. You can also check your application against known vulnerabilities using the Vulert playground at Vulert Scanner.
