Malware in tailwindcss-animationkit npm package — full compromise of installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub published a malware advisory (GHSA-2hrf-5wrm-jw55, CWE-506) for the npm package tailwindcss-animationkit. All published versions (= 0) are considered malicious, with no patched versions available. The advisory states that any computer with the package installed or running should be considered fully compromised, with possible full control handed to an outside entity, and that removing the package does not guarantee removal of resulting malicious software. Any developer or CI environment that installed the package is affected; secrets and keys on those machines are presumed stolen. There is no fix — remediation is removal, machine rebuild, and credential rotation.
What to do
- Rotate all secrets, keys, and tokens that were stored on or accessible from machines where the package was installed, using a clean computer
- Remove tailwindcss-animationkit from all projects and lockfiles and rebuild affected machines from trusted images
- Audit install logs, CI caches, and dependency trees for other uses of the package
- Review access and network logs for signs of attacker activity following installation
- Add the package to blocklists / denylists in dependency scanning and CI
Sources
All live incidents on Threat Watch
