Supply chain · npm · High

Critical npm Package 'animatecss-postcss-plugin' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-02

The npm package 'animatecss-postcss-plugin' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately from a separate, secure machine.

  • Package: npm / animatecss-postcss-plugin
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~208/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'animatecss-postcss-plugin' npm package contains malware. Installation of this package results in the complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component, when integrated into a project, executes unauthorized code. This typically involves the package's installation script or main logic performing actions beyond its declared purpose, such as exfiltrating data or establishing persistent access.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package updates
  • Any user or system that has installed 'animatecss-postcss-plugin'

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that may not filter malicious packages
  • Direct or transitive dependency on 'animatecss-postcss-plugin'

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, lateral movement within the network, or further malware deployment.
  • All secrets, credentials, and sensitive data stored on the compromised machine are exposed and likely stolen.
  • The integrity of development environments and build processes is compromised, potentially leading to further supply chain attacks.

What to do (defensive)

Detect

  • Scan dependency trees for 'animatecss-postcss-plugin' in any version.
  • Monitor network traffic for unusual outbound connections from systems that have installed npm packages.
  • Review system logs for suspicious process execution or file modifications post-package installation.

Contain

  • Immediately isolate any system identified with 'animatecss-postcss-plugin' installed.
  • Block network access for compromised systems to prevent further data exfiltration or command and control.
  • Suspend all CI/CD pipelines that might pull or build projects depending on this package.

Remediate

  • Consider any system that installed 'animatecss-postcss-plugin' fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, performing rotations from a clean, uncompromised machine.
  • Remove 'animatecss-postcss-plugin' from all project dependencies and ensure lockfiles are updated to prevent re-introduction.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate system isolation and credential rotation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.