Malicious Code Injection in tailwind-kinetic: A Critical Vulnerability
Summary
MAL-2026-18084: Malicious code in tailwind-kinetic (npm). Affects tailwind-kinetic versions 2.0.6 – 2.0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tailwind-kinetic is a Tailwind CSS plugin designed to enhance animations within web applications. It allows developers to easily integrate animations into their projects using Tailwind's utility-first approach. However, this package has been compromised, leading to serious security concerns due to the inclusion of malicious code that can execute when the plugin is loaded.
Vulnerability Detail
The vulnerability stems from the tailwind-kinetic package versions 2.0.6 and 2.0.8, which were published by a malicious actor as part of a fake job interview campaign. The package requires a private scoped dependency, @aaron205whitmore/postcss-animate-utils, which is not accessible on the public npm registry. This dependency contains malicious code that executes when the tailwind.config.js file loads the plugin, potentially compromising the developer's environment and application. The malicious code is hidden within a private dependency that is only retrievable using a specific npm token, making it difficult to detect.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwind-kineticIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tailwind-kinetic package until a fix is provided. If you need similar functionality, consider using alternative animation libraries that are known to be secure.
Conclusion
The tailwind-kinetic package has been identified as having a critical vulnerability due to the inclusion of malicious code in its dependencies. Developers using this package should take immediate action to update or remove it to protect their applications. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for tailwind-kinetic →
FAQ
tailwind-kinetic is a plugin for Tailwind CSS that allows developers to easily add animations to their web applications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If you have installed tailwind-kinetic versions 2.0.6 or 2.0.8, you should update to a patched version or remove the package until a secure version is released.
Using the compromised package can lead to unauthorized code execution in your development environment, potentially exposing sensitive data or compromising your application.
Regularly monitor your dependencies using tools like Vulert, and keep your packages updated to the latest secure versions to minimize the risk of vulnerabilities.
