Supply chain · npm · High

Critical Malware in npm Package 'tailwindcss-animatecss-keyframes'

Threat Engine Auto-Feed · data current as of 2026-10-07

A critical malware package, 'tailwindcss-animatecss-keyframes', has been identified in the npm ecosystem. Any system that installed this package should be considered fully compromised, necessitating immediate secret rotation and thorough remediation efforts.

  • Package: npm / tailwindcss-animatecss-keyframes
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~164/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'tailwindcss-animatecss-keyframes' contains malware. Installation of this package leads to a complete compromise of the host system, allowing an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is distributed through a public registry. Upon installation, the malicious code executes, establishing unauthorized access and control over the compromised system, typically for credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using npm for frontend or full-stack projects
  • CI/CD pipelines that automatically pull new package versions
  • Organizations with internal package mirrors that have synchronized this package

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to the malicious version
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) to ensure consistent dependency versions
  • Direct or transitive dependency on 'tailwindcss-animatecss-keyframes'

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen, including API keys, access tokens, and credentials.
  • The blast radius extends to any systems or services accessible from the compromised host, potentially impacting source code repositories, cloud environments, or production systems.

What to do (defensive)

Detect

  • Scan project dependency trees for 'tailwindcss-animatecss-keyframes'.
  • Review package installation logs for evidence of 'tailwindcss-animatecss-keyframes' being pulled.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.

Contain

  • Immediately isolate any systems identified as having installed 'tailwindcss-animatecss-keyframes' from the network.
  • Suspend all CI/CD pipelines and development environments that could have installed this package.
  • Block 'tailwindcss-animatecss-keyframes' from being downloaded from package registries or internal mirrors.

Remediate

  • Consider any system that installed 'tailwindcss-animatecss-keyframes' to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, user credentials) that were stored on or accessible from the compromised systems, performing rotations from a different, trusted computer.
  • Thoroughly audit all code repositories for unauthorized changes or injected malicious code, especially if developer machines were compromised.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system rebuilds due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.