{"id":"MAL-2026-18089","kind":"package","aliases":["MAL-2026-18089"],"related":[],"title":"Malicious code in tailwindcss-motionanimate (npm)","description":"tailwindcss-motionanimate (1.0.1) is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package @jasperquinn/postcss-motion-helpers, which is not readable on the public registry and resolves only with the npm token committed in the lure repository's web/.npmrc, so the code it delivers runs when tailwind.config.js loads the plugin and the dev server starts. The published tarball contains no install scripts and no network code; the payload lives in the private dependency, which was not retrieved. Twenty-six such packages under seventeen accounts were published between 2026-07-28 and 2026-10-09.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"tailwindcss-motionanimate","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T00:00:00+00:00","first_seen_at":"2026-10-26T20:51:48+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-07':137C '-09':55C,142C '-10':141C '-17665':37C '-17666':41C '-18089':10A,13A '-2026':9A,12A,36C,40C '-28':56C,138C '1.0.1':22C '2026':54C,136C,140C '5':58C 'account':132C 'animate.css':44C 'behind':34C 'campaign':33C 'code':2A,89C,113C 'commit':80C 'contain':106C 'css':26C 'deliv':91C 'depend':120C 'descript':49C 'dev':100C 'doublekk61':52C 'fake':30C 'instal':108C 'integr':45C 'interview':32C 'jasperquinn/postcss-motion-helpers':64C 'job':31C 'live':116C 'load':95C 'lure':83C 'mal':8A,11A,35C,39C 'malici':1A,17B 'motionanim':6A,21C 'motionanimate':16A 'network':112C 'npm':7A,78C 'packag':18B,63C,129C 'payload':115C 'plugin':27C,97C 'privat':61C,119C 'public':71C 'publish':50C,104C,134C 'readabl':68C 'readm':47C 'registri':72C 'repositori':84C 'requir':59C 'resolv':74C 'retriev':124C 'run':92C 'scope':62C 'script':109C 'server':101C 'seventeen':131C 'six':127C 'src/motion.js':57C 'start':102C 'tailwind':25C 'tailwind.config.js':94C 'tailwindcss':5A,15A,20C 'tailwindcss-motionanim':4A,19C 'tailwindcss-motionanimate':14A 'tarbal':105C 'templat':46C 'token':79C 'twenti':126C 'twenty-six':125C 'web/.npmrc':86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18089","url":"https://osv.dev/vulnerability/MAL-2026-18089","severity":"critical","published_at":"2026-10-19T00:00:00+00:00","modified_at":"2026-10-20T06:15:05+00:00","first_seen_at":"2026-10-26T20:51:48+00:00","fetched_at":"2026-10-26T20:51:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}