Supply chain · npm · High

Critical Malicious Package Found in npm: tailwind-modernanimation

Threat Engine Auto-Feed · data current as of 2026-08-31

A malicious version of the `tailwind-modernanimation` npm package (2.3.8) contains concealed code that establishes persistent remote code execution. This package, disguised as a Tailwind CSS animation plugin, poses a critical supply-chain risk to any environment where it is installed and executed during a build process.

  • Package: npm / tailwind-modernanimation
  • Affected versions: = 2.3.8
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package `tailwind-modernanimation` version 2.3.8, which purports to be a Tailwind CSS animation plugin, was found to contain malicious code. This code is hidden within the `src/index.js` file, appended after the legitimate plugin export, and is designed to execute upon module loading during a consumer's CSS build process.

How the attack works

The attack leverages a concealed `eval(atob('...'))` call within the package. When the module is loaded, this call decodes and executes a payload. This payload queries public Ethereum RPCs to retrieve C2 server IP addresses, then fetches and executes additional JavaScript code over HTTP. This results in a detached, hidden Node.js child process that provides persistent remote code execution capabilities to the attacker on the compromised machine.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest dependencies
  • Developers or build systems that have installed `tailwind-modernanimation` version 2.3.8

Conditions that increase exposure

  • Projects with `tailwind-modernanimation` version 2.3.8 listed as a dependency
  • Build environments that do not use strict dependency pinning or lockfiles
  • Environments where network egress to external IP addresses is not restricted
  • Internal package mirrors that have synchronized the malicious version

Blast-radius scenarios

  • An attacker gains persistent remote code execution on build machines or developer workstations where the package is installed and executed.
  • Compromised systems could be used as a beachhead for further internal network penetration or data exfiltration.
  • The attacker can rotate C2 endpoints without republishing the package, making detection and blocking more challenging.

What to do (defensive)

Detect

  • Scan project dependencies for `tailwind-modernanimation` version 2.3.8.
  • Monitor network traffic from build environments for unexpected outbound connections to external IP addresses, especially on port 443 over HTTP.
  • Review package integrity by comparing installed package contents against known good versions or hashes.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately isolate any systems identified as having installed `tailwind-modernanimation` version 2.3.8.
  • Block network egress from build environments to untrusted external IP addresses.
  • Remove `tailwind-modernanimation` version 2.3.8 from all project dependencies and package caches.
  • Quarantine or rebuild any artifacts produced by compromised build systems.

Remediate

  • Remove `tailwind-modernanimation` version 2.3.8 from all `package.json` files and `package-lock.json` files.
  • Force a full dependency re-installation (`npm ci` or `npm install --force`) after removing the malicious package.
  • Rotate credentials and API keys that may have been exposed on compromised build systems or developer machines.
  • Implement strict dependency pinning and use lockfiles in all projects to prevent automatic updates to malicious versions.
  • Consider implementing a package allowlist or using private package registries with strict vetting.

Frontier verdict — High

Prioritize immediate detection and removal of `tailwind-modernanimation` version 2.3.8 due to critical remote code execution risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.