Malicious npm packages: tailwind-animate-test, tailwind-animate-final, tailwind-animatrix, tailwind-animate-engine — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub published four malware advisories on 2026-11-02 for npm packages tailwind-animate-test (GHSA-vpvh-94mq-8h4j), tailwind-animate-final (GHSA-4hf4-p92p-5m6c), tailwind-animatrix (GHSA-rfxc-3373-jvfq) and tailwind-animate-engine (GHSA-rqhx-p7qj-qqc8). All versions (= 0) are affected and no patched versions exist; the packages contain embedded malicious code (CWE-506) and appear to be typosquat-style malicious packages targeting Tailwind animation tooling. GitHub states any computer with these packages installed or running should be considered fully compromised, implying credential and secret theft with attacker control. Removal of the package does not guarantee removal of the malicious software. No fix is available; remediation is removal plus full incident response.
What to do
- Check lockfiles and node_modules for tailwind-animate-test, tailwind-animate-final, tailwind-animatrix or tailwind-animate-engine and remove them from all projects and CI caches
- Treat any machine or CI runner where they were installed as fully compromised: rotate all secrets, keys, tokens and credentials from a clean machine
- Rebuild affected environments from trusted images and audit for persistence mechanisms
- Block the package names in npm registries, proxy repositories and dependency firewall policies
- Review npm install logs to determine exposure window and scope
Sources
All live incidents on Threat Watch
