Which versions of animated-css-kit are malicious?

The following npm versions of animated-css-kit are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate animated-css-kit if I installed it?

animated-css-kit is a typosquat — you almost certainly intended a legitimately-named package. Remove animated-css-kit, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed animated-css-kit — how do I know if it already compromised me?

If animated-css-kit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is animated-css-kit part of a known attack campaign?

Yes — animated-css-kit is associated with the IN-MAL-2026-010200 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find animated-css-kit across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for animated-css-kit (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging animated-css-kit across your stack and pipelines.

Malicious package

animated-css-kitnpm

Malicious code in animated-css-kit (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10432

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall animated-css-kit

What this malware does

The package presents itself as a PostCSS plugin for animate.css, but its main export (src/plugin.js createPlugin) synchronously triggers src/side-effects.js, which is heavily obfuscated (obfuscator.io string-array with RC4 decoding, anti-debug via Function.prototype.toString inspection, console-method hijacking) while the rest of the src/*.js tree is plain unobfuscated PostCSS code. The obfuscated module fetches a remote JSON payload, base64-decodes its message field, and executes it via new Function('require', m)(require), handing the caller's require to attacker-supplied code with retry-up-to-10-times logic. This fires when a consumer imports the package and instantiates the exported plugin (the documented usage in a build pipeline), giving the attacker arbitrary code execution on the installer/build machine with full access to the surrounding Node.js environment. The clean plugin surface + targeted obfuscation of only the network-and-eval module + evocative name mimicking the animate.css ecosystem are consistent with a supply-chain attack using a cover-story package.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for animated-css-kit (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging animated-css-kit across your stack and pipelines.
If you installed it — respond
animated-css-kit is a typosquat — you almost certainly intended a legitimately-named package. Remove animated-css-kit, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If animated-css-kit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks animated-css-kit before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. animated-css-kit on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010200

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks animated-css-kit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring