Critical Malicious Code Vulnerability in tailwindcss-animation-modern Package
Summary
MAL-2026-754: Malicious code in tailwindcss-animation-modern (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tailwindcss-animation-modern package is a utility library designed to enhance animations in web applications built with Tailwind CSS. It provides developers with pre-defined animation classes that can be easily integrated into their projects. However, this package has been compromised, leading to serious security concerns for any system utilizing it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the tailwindcss-animation-modern package. This code can fully compromise any computer that has the package installed or running, allowing unauthorized access to sensitive information such as secrets and keys. The malicious code is designed to operate stealthily, making it difficult to detect and remove, thus posing a significant risk to users and their data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwindcss-animation-modernIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can replace the functionality provided by tailwindcss-animation-modern with alternative animation libraries that are known to be secure. Additionally, consider using a local version of the animations you need, avoiding the use of this compromised package altogether.
Conclusion
The tailwindcss-animation-modern package has been compromised with malicious code, posing a significant threat to users. Immediate action is required to remove the package and secure sensitive information. Utilizing tools like Vulert can help in monitoring and preventing future vulnerabilities.
See every vulnerability recorded for tailwindcss-animation-modern →
FAQ
Immediately remove the package from your project and rotate any sensitive information stored on the affected system.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without requiring any installation.
Regularly audit your dependencies and utilize tools like Vulert to monitor for vulnerabilities in real-time.
The primary risk is unauthorized access to sensitive data, which can lead to data breaches and loss of control over your system.
It is advisable to review the security history of other packages from the same source and consider using alternatives that have a proven track record of security.
