Which versions of tailwind-modernanimation are malicious?

The following npm versions of tailwind-modernanimation are flagged malicious: 2.3.8. Treat any of these as compromised.

How do I remediate tailwind-modernanimation if I installed it?

tailwind-modernanimation establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed tailwind-modernanimation — how do I know if it already compromised me?

If tailwind-modernanimation was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tailwind-modernanimation part of a known attack campaign?

Yes — tailwind-modernanimation is associated with the IN-MAL-2026-019299 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tailwind-modernanimation across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tailwind-modernanimation (version 2.3.8).

Malicious package

tailwind-modernanimationnpm

Advisory published Aug 31, 2026Updated Aug 31, 2026

tailwind-modernanimation is a confirmed malicious npm package (MAL-2026-15635) that opens a backdoor for remote access (malicious version 2.3.8). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tailwind-modernanimation (npm)

MAL-2026-15635

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tailwind-modernanimation

What this malware does

The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an eval(atob('...')) call at module top level after the plugin export, concealed by a long run of trailing spaces and tabs. When the module is loaded (Tailwind plugin resolution during a consumer's CSS build), the decoded payload queries public Ethereum RPCs for the most recent transaction sent by the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from bytes of the transaction's to field, fetches JavaScript over plain HTTP from http://<ip>:443/0x/cls and http://<ip>:443/0x/ls, and executes it via spawn('node', ['-e', env+code], {detached:true, stdio:'ignore', windowsHide:true}).unref(). The detached, hidden Node child survives the parent build process and continues to poll the resolved hosts, giving the operator persistent remote code execution on any machine that builds a project depending on this package. The Ethereum-based dead-drop lets the operator rotate C2 endpoints without republishing the package.

Malicious versions

1 flagged

2.3.8

Indicators of compromise (SHA-256)

05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for tailwind-modernanimation (version 2.3.8).
If you installed it — respond
tailwind-modernanimation establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If tailwind-modernanimation was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tailwind-modernanimation on npm has been identified as a malicious package (version 2.3.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019299

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks tailwind-modernanimation-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database