{"id":"MAL-2026-18078","kind":"package","aliases":["MAL-2026-18078"],"related":[],"title":"Malicious code in tailwind-animate-kit (npm)","description":"tailwind-animate-kit (2.0.6, 2.0.7, 2.0.8) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"tailwind-animate-kit","fixed":[],"affected":"= 2.0.6; = 2.0.7; = 2.0.8","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T00:00:00+00:00","first_seen_at":"2026-10-26T20:51:48+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-07':144C '-09':62C,149C '-10':148C '-17665':42C '-17666':46C '-18078':11A,14A '-2026':10A,13A,41C,45C '-28':63C,145C '2.0.6':25C '2.0.7':26C '2.0.8':27C '2026':61C,143C,147C '5':65C 'account':139C 'anim':6A,23C 'animate':17A 'animate.css':49C 'behind':39C 'campaign':38C 'code':2A,96C,120C 'commit':87C 'contain':113C 'css':31C 'deliv':98C 'depend':127C 'descript':54C 'dev':107C 'fake':35C 'instal':115C 'integr':50C 'interview':37C 'jasperquinn/postcss-motion-helpers':71C 'jh':59C 'job':36C 'keinsel':58C 'keinsell-jh':57C 'kit':7A,18A,24C 'live':123C 'load':102C 'lure':90C 'mal':9A,12A,40C,44C 'malici':1A,19B 'network':119C 'npm':8A,85C 'packag':20B,70C,136C 'payload':122C 'plugin':32C,104C 'privat':68C,126C 'public':78C 'publish':55C,111C,141C 'readabl':75C 'readm':52C 'registri':79C 'repositori':91C 'requir':66C 'resolv':81C 'retriev':131C 'run':99C 'scope':69C 'script':116C 'server':108C 'seventeen':138C 'six':134C 'src/motion.js':64C 'start':109C 'tailwind':5A,16A,22C,30C 'tailwind-animate-kit':4A,15A,21C 'tailwind.config.js':101C 'tarbal':112C 'templat':51C 'token':86C 'twenti':133C 'twenty-six':132C 'web/.npmrc':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18078","url":"https://osv.dev/vulnerability/MAL-2026-18078","severity":"critical","published_at":"2026-10-19T00:00:00+00:00","modified_at":"2026-10-20T06:15:06+00:00","first_seen_at":"2026-10-26T20:51:48+00:00","fetched_at":"2026-10-26T20:51:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}