{"id":"MAL-2026-18079","kind":"package","aliases":["MAL-2026-18079"],"related":[],"title":"Malicious code in tailwind-animatecss-kit (npm)","description":"tailwind-animatecss-kit (2.0.6) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"tailwind-animatecss-kit","fixed":[],"affected":"= 2.0.6","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T00:00:00+00:00","first_seen_at":"2026-10-26T20:51:47+00:00","triaged_at":"2026-10-26T21:04:10+00:00","updated_at":"2026-10-26T21:04:10+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-07':140C '-09':58C,145C '-10':144C '-17665':40C '-17666':44C '-18079':11A,14A '-2026':10A,13A,39C,43C '-28':59C,141C '2.0.6':25C '2026':57C,139C,143C '5':61C 'account':135C 'animate.css':47C 'animatecss':6A,17A,23C 'behind':37C 'campaign':36C 'code':2A,92C,116C 'commit':83C 'contain':109C 'css':29C 'deliv':94C 'depend':123C 'descript':52C 'dev':103C 'fake':33C 'instal':111C 'integr':48C 'interview':35C 'jasperquinn/postcss-motion-helpers':67C 'job':34C 'killerdev1127':55C 'kit':7A,18A,24C 'live':119C 'load':98C 'lure':86C 'mal':9A,12A,38C,42C 'malici':1A,19B 'network':115C 'npm':8A,81C 'packag':20B,66C,132C 'payload':118C 'plugin':30C,100C 'privat':64C,122C 'public':74C 'publish':53C,107C,137C 'readabl':71C 'readm':50C 'registri':75C 'repositori':87C 'requir':62C 'resolv':77C 'retriev':127C 'run':95C 'scope':65C 'script':112C 'server':104C 'seventeen':134C 'six':130C 'src/motion.js':60C 'start':105C 'tailwind':5A,16A,22C,28C 'tailwind-animatecss-kit':4A,15A,21C 'tailwind.config.js':97C 'tarbal':108C 'templat':49C 'token':82C 'twenti':129C 'twenty-six':128C 'web/.npmrc':89C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18079","url":"https://osv.dev/vulnerability/MAL-2026-18079","severity":"critical","published_at":"2026-10-19T00:00:00+00:00","modified_at":"2026-10-20T06:15:04+00:00","first_seen_at":"2026-10-26T20:51:47+00:00","fetched_at":"2026-10-26T20:51:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}