MAL-2026-12218 Malicious code in tailwind-animation-founder (npm)
Malicious package
Published
MAL-2026-12218 is a malicious package: tailwind-animation-founder (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12218/ (Markdown: https://insights.sbomify.com/MAL-2026-12218/index.md)
- Package
- tailwind-animation-founder
- Registry
- npm
What is MAL-2026-12218?
MAL-2026-12218 is a malicious package in tailwind-animation-founder, published on 5 Aug 2026.
Official description
The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream ('tailwindcss-animationfound'), indicating a typosquat identity. src/index.js appends an obfuscated IIFE after a legitimate-looking Tailwind plugin export. The trailing block pulls http, https, and child_process.spawn into globals, uses a length-based string-shuffle routine to reconstruct the identifier 'constructor', instantiates a Function from a shuffle-decoded source blob, and immediately invokes it. The executable payload is only readable after runtime decoding, so the plugin performs opaque code execution the moment a build tool runs require('tailwind-animation-founder'). The combination of obfuscation, networking primitives (http/https), process-spawn capability, and Function-constructor evaluation on the main entry is the shape of a dropper/stealer, not a Tailwind utility plugin.
What should I do about MAL-2026-12218?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.