Malicious Code Injection in tailwindcss-effect-lab: A Critical Vulnerability
Summary
MAL-2026-18087: Malicious code in tailwindcss-effect-lab (npm). Affects tailwindcss-effect-lab versions 0.0.0-stage – 1.6.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tailwindcss-effect-lab is a Tailwind CSS plugin designed to enhance the styling capabilities of web applications. It allows developers to easily integrate animations and effects into their projects. However, this package has been compromised, making it susceptible to malicious code execution, which can lead to severe security risks for applications utilizing this plugin.
Vulnerability Detail
The vulnerability originates from the inclusion of a private scoped package, @aaron205whitmore/postcss-animate-utils, which is not accessible on the public npm registry. This package is required in the src/motion.js file and is only retrievable with a specific npm token found in the lure repository's .npmrc file. When the tailwind.config.js file loads the plugin, the malicious code embedded in the private dependency executes, potentially compromising the application. This issue affects versions 0.0.0-stage and 1.6.7 of tailwindcss-effect-lab, and it is part of a broader malicious campaign involving multiple packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tailwindcss-effect-labIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tailwindcss-effect-lab package until a secure version is released. Additionally, ensure that your project does not include any private dependencies that could pose a security risk.
Conclusion
The tailwindcss-effect-lab package has been identified as containing malicious code that can compromise applications using it. It is essential to take immediate action by updating the package or removing it to safeguard your application from potential threats. Regular monitoring for vulnerabilities is crucial for maintaining application security.
See every vulnerability recorded for tailwindcss-effect-lab →
FAQ
tailwindcss-effect-lab is a plugin for Tailwind CSS that allows developers to add animations and effects to their web applications.
The vulnerability can lead to the execution of malicious code within your application, potentially compromising sensitive data and application integrity.
You should update to the latest version of tailwindcss-effect-lab or remove it from your project until a secure version is available.
You can use Vulert, which monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities in your software.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
