29 fake-interview Tailwind and Animate.css npm plugins hide their payload in private scopes unlocked by a committed `.npmrc` token

high

CVE

Not assigned

CWE

CWE-506, CWE-829

Affected Surface

43 public npm packages posing as Tailwind CSS Animate.css, PostCSS, and Framer Motion plugins (published across 23+ accounts between 28 July and 30 October 2026); on 29 October 2026, npm replaced 6 public packages (`tailwind-animate-kit`, `tailwind-animationlab`, `tailwind-keyframes`, `tailwind-kinetic`, `tailwindcss-animate-catalog`, and `tailwindcss-keyframe-kit`) plus the private scope `@jasperquinn/postcss-motion-helpers` with `0.0.1-security` placeholders, and within hours on 29-30 October the operators published 4 brand-new public packages (`tw-motion-css`, `tailwindcss-animate-bridge`, `fast-deep-thinking`, and `framer-motionanimate`), 4 additional October packages (`animatecss-tailwind-keyframes`, `tailwind-kinetics`, `tailwind-kinetix`, and `motion-helpers-compat`), and 2 updated releases (`signalledger-bridge@2.0.8` and `tailwindcss-visual-kit@1.3.7`), leaving 28 public packages live on `registry.npmjs.org`
7 private scoped npm payload packages (`@aaron205whitmore/postcss-animate-utils`, `@jasperquinn/postcss-motion-helpers` [replaced with `0.0.1-security` on 29 October 2026 under `GHSA-88vx-c9pj-9527`], and 5 replacement scopes introduced through 30 October 2026: `@nexlayerlabs/postcss-keyframe-utils`, `@claudeorg/universal-code-generator`, `@doublekk61_pro/postcss-motion-animation`, `@utilitycraft/tailwindcss-motion-atelier`, and `@codentra/postcss-kinetix`), fetched during `npm install` only when an attacker-supplied `.npmrc` auth token is present
Developer machines and AI coding agents (Claude Code, Cursor, Windsurf, Copilot) that ran `npm install` and `npm run dev` / `next dev` inside fake technical-assessment repositories such as `Nodveta-Infra/backend-engineer-assessment` (Torre.ai) or `BlockRoute Labs` (Djinni.co)

Update, 30 October 2026: Within five hours of npm’s 29 October (15:14 UTC) takedown of the private bridge scope @jasperquinn/postcss-motion-helpers, the operators rotated to five new private npm scopes (@nexlayerlabs/postcss-keyframe-utils, @claudeorg/universal-code-generator, @doublekk61_pro/postcss-motion-animation, @utilitycraft/tailwindcss-motion-atelier, and @codentra/postcss-kinetix), pushed updated releases of two existing packages (tailwindcss-visual-kit@1.3.7 at 20:25 UTC on 29 October and signalledger-bridge@2.0.8 at 01:19 UTC on 30 October) that swap @jasperquinn/postcss-motion-helpers for @nexlayerlabs/postcss-keyframe-utils, and published four brand-new public packages on 30 October (tw-motion-css@2.0.2 at 04:53 UTC, tailwindcss-animate-bridge@2.0.8 at 05:40 UTC with the private require() moved to lib/catalog/source.js:5, fast-deep-thinking@1.0.1 at 07:43 UTC, and framer-motionanimate@14.7.2 at 08:42 UTC). Static scanning by Gatekeeper (OpenSSF PR #1694) also uncovered four earlier October packages from the same template (animatecss-tailwind-keyframes 1.0.0/2.0.2 and motion-helpers-compat 1.3.7/1.3.8 by elony16, tailwind-kinetics@2.0.7 by isaac9089, and tailwind-kinetix@2.0.7 by ronald9373). All 8 newly reported packages and both updated packages were confirmed live on registry.npmjs.org on 30 October (28 of the 43 tracked public packages remain live). We have added all 8 packages and 5 new private scopes to the inventory table, IOCs, and detection command below.

Update, 29 October 2026: Between 14:49 UTC and 15:17 UTC on 29 October, npm replaced six more public packages from this cluster plus one of the two private scoped payload packages with 0.0.0-stage and 0.0.1-security security-holding releases and published seven new GitHub Malware Advisories: GHSA-88vx-c9pj-9527 (@jasperquinn/postcss-motion-helpers), GHSA-282x-w96h-wv7f (tailwindcss-keyframe-kit), GHSA-4mf5-57pc-vj85 (tailwindcss-animate-catalog), GHSA-7cm4-74gj-gfp2 (tailwind-animationlab), GHSA-vh6h-8m24-j9mj (tailwind-keyframes), GHSA-w9j6-p46m-xvp4 (tailwind-animate-kit), and GHSA-j2r4-xxhh-xx58 (tailwind-kinetic). Converting @jasperquinn/postcss-motion-helpers into a public 0.0.1-security placeholder neutralizes the runtime bridge for all 16 public packages that required @jasperquinn/postcss-motion-helpers during npm install. However, our registry check on 29 October confirms that @aaron205whitmore/postcss-animate-utils still returns 404 (private) and 20 of the original 29 public packages (including 10 packages wired to @aaron205whitmore/postcss-animate-utils) remain live and unreplaced on registry.npmjs.org. We have updated the status column in the inventory table below.

Update, 26 October 2026: At 16:17 UTC on 26 October, npm replaced three more CSS/PostCSS utility packages with 0.0.1-security placeholders and published GHSA-p597-2ggw-c82r (birch-css-utils, versions 1.1.0 and 1.2.2), GHSA-j658-c56g-qxh4 (harlow-css-mixer), and GHSA-fh55-fq5h-h352 (postcss-semantic-themes). Static analysis by CyberXYZ (OpenSSF PR #1666) and Amazon Inspector confirmed that birch-css-utils ships an index.mjs file (~291 KB, SHA-256 d7f2e6126f30199d791c30c52560c06205640a26ea17ceb53a06231be653d976) and build-cache.mjs (~177 KB, SHA-256 e5b7ff8f65cd07d2bc7e0c301dfadd06d871dbdffa9e834c9a18229a897dd4c6) that are byte-identical to noelc-css-blender and carry fabricated header comments claiming to be auto-generated by tailwindcss-theme-kit@0.2.0 (“restore from package-lock if corrupted”). Unlike the earlier @aaron205whitmore / @jasperquinn private-scope bridge packages, this noelc-css-blender / birch-css-utils / harlow-css-mixer / postcss-semantic-themes / tailwindcss-theme-kit subgroup inlines its 468 KB custom-encoded payload directly into index.mjs and build-cache.mjs so it executes on import or require without needing a private .npmrc token. We have added all three 26 October packages to the inventory table and detection command below (now tracking 35 public packages).

Update, 25 October 2026: Late on 24 October and early on 25 October (23:54 UTC to 00:05 UTC), npm replaced three additional Tailwind CSS plugin packages with 0.0.0-stage and 0.0.1-security placeholders and published GHSA-cj2x-975v-jmwf (noelc-css-blender, which had pushed seven rapid versions 1.0.0, 1.1.0, 2.2.0, 2.2.1, 2.1.9, 2.1.10, and 2.1.11 between 11:33 UTC and 20:09 UTC on 24 October), GHSA-v5xr-xjx7-ggwf (tailwindcss-theme-kit), and GHSA-5j43-343m-gggg (tailwind-base-buttons 0.1.0, first published 12 October, a lookalike of the legitimate tailwindcss-base-buttons plugin). Meanwhile, our registry check on 25 October confirms that the 26 public packages from the 20 October GHSA wave (animate-tailwind-kit through tailwindcss-visual-kit) are still live and unreplaced on registry.npmjs.org. We have added the three newly removed packages to the inventory and detection regex below, bringing the tracked cluster to 32 public packages.

TL;DR

On 20 October 2026, the GitHub Advisory Database ingested 26 npm malware advisories (GHSA-q29m-3m5r-fmjj through GHSA-m8c8-f5hx-664g) that join three earlier October reports into a 29-package fake-interview campaign. Every package in the cluster presents itself as an Animate.css utility plugin for Tailwind CSS (tailwind-animatecss-uniform, animate-twcss-bridge, animate-tailwind-kit, signalledger-bridge, and 25 siblings).

What makes this cluster stand out is how it defeats both npm install --ignore-scripts and static registry scanners:

The public npm tarballs contain no malware and no lifecycle hooks. They are working ~12 KB Tailwind plugins that parse animate.css keyframes and generate utilities.
Line 5 of src/motion.js (or lib/styles/variables.js / src/generators/motion-base.js in two variants) requires either @aaron205whitmore/postcss-animate-utils or @jasperquinn/postcss-motion-helpers. Without authentication, registry.npmjs.org returns HTTP 404 for both scopes, so an ordinary public install fails immediately.
Candidates recruited through fake job postings on Torre.ai (“Nodveta”, nodveta[.]com) and Djinni.co (“BlockRoute Labs”, blockroutelabs[.]com) are invited to a private GitHub assessment repository whose web/.npmrc commits a plaintext read-only npm token (//registry.npmjs.org/:_authToken=...). That token lets npm install fetch the private scoped package, and starting the dev server (npm run dev or next dev) loads tailwind.config.js, which executes the private package inside the Node.js process.
The final commit in Nodveta-Infra/backend-engineer-assessment adds web/AGENTS.md and web/CLAUDE.md files that tell AI coding agents the project uses an unfamiliar Next.js version and instruct the agent to read documentation inside node_modules/, nudging the agent into running npm install and the dev build automatically.

When we checked registry.npmjs.org on 22 October 2026, only 3 of the 29 public packages had been replaced with 0.0.1-security placeholders. The other 26 packages were still live and installable. If you or an AI agent ran npm install or npm run dev inside a take-home assessment repository that contained a committed .npmrc token or any of the 29 packages below, treat the workstation as compromised and rotate every credential it held.

How the two-piece loader works

We downloaded the live tarballs for animate-twcss-bridge@2.0.6 (SHA-256 5945136df8a863e12eb0a3f1f72fe6cb19a51b1f51344346e50398fd5d2fbaf2) and animate-twcss-pack@2.0.6 (SHA-256 e83b87c4b8be50e081710c1aaf45486e35aadb2d8a0170e1ee6a6c7a63f62efc) to a scratch directory and inspected their contents statically without executing anything.

Every malicious version ships the same template. Here is package.json from animate-twcss-bridge@2.0.6:

{
  "name": "animate-twcss-bridge",
  "version": "2.0.6",
  "description": "A configurable, namespaced Animate.css integration for Tailwind CSS",
  "main": "plugin.js",
  "exports": "./plugin.js",
  "files": [
    "plugin.js",
    "src",
    "README.md",
    "LICENSE"
  ],
  "homepage": "https://sericpieap.github.io/animate-twcss-bridge/",
  "repository": "https://github.com/sericpieap/animate-twcss-bridge/",
  "author": "sericpieap",
  "license": "MIT",
  "scripts": {
    "lint": "eslint . --ext .js",
    "test": "node --test"
  },
  "dependencies": {
    "animate.css": "^4.1.1",
    "postcss": "^8.4.5",
    "@aaron205whitmore/postcss-animate-utils": "^1.0.1",
    "postcss-js": "^3.0.3",
    "postcss-selector-parser": "^6.0.8"
  }
}

There is no preinstall, install, or postinstall script. In 22 of the 29 packages, the author field is hardcoded to sericpieap and the repository URL points to a GitHub account that returns 404.

The entry point plugin.js registers a standard Tailwind CSS plugin that calls buildStyles(loadCatalog(), config), which in turn calls buildMotionBase(config) in src/motion.js:

'use strict';

const postcss = require('postcss');
const postcssJs = require('postcss-js');
const postcssAnimateUtils = require('@aaron205whitmore/postcss-animate-utils');

function toPostcssOptions(config) {
  return {
    variables: {
      enabled: true,
      selector: ':root',
      prefix: 'keyframe',
      preserveExisting: false,
      values: {
        duration: config.duration,
        delay: config.delay,
        iterationCount: config.iterationCount
      }
    },
    rewrite: false,
    namespace: null,
    webkit: false,
    reducedMotion: false
  };
}

function buildMotionBase(config) {
  const processor = postcss([postcssAnimateUtils(toPostcssOptions(config))]);
  const result = processor.process('', { from: undefined }).sync();
  return postcssJs.objectify(result.root);
}

module.exports = { buildMotionBase, toPostcssOptions };

Line 5 (const postcssAnimateUtils = require('@aaron205whitmore/postcss-animate-utils');, or @jasperquinn/postcss-motion-helpers in the second subgroup) is the entire bridge to the payload:

When an automated scanner or researcher tries to install animate-twcss-bridge outside the lure repository, npm requests https://registry.npmjs.org/@aaron205whitmore%2fpostcss-animate-utils without a bearer token for that scope and receives 404 Not Found.
When a job candidate clones the assessment repository (Nodveta-Infra/backend-engineer-assessment) and runs npm install inside web/, npm reads web/.npmrc, authenticates with the attacker’s read-only token, and pulls the private scoped package into node_modules/.
As soon as the candidate or their coding agent runs npm run dev, next dev, vite, or tailwindcss, PostCSS loads tailwind.config.js, which requires the public plugin and immediately executes the private scoped package inside the dev server process.

Two of the 29 packages (tailwindcss-keyframe-kit and tailwindcss-animate-catalog, both published by hackson306623) move that require() out of src/motion.js into src/generators/motion-base.js:5 and lib/styles/variables.js:5 respectively. Two others (tailwind-animate-kit and tailwind-kinetic, both published by keinsell-jh) shipped a clean 2.0.6 version first before adding the private dependency in 2.0.7 and 2.0.8.

Operator pairing across 17 npm accounts

Across the 29 public packages, 13 require @aaron205whitmore/postcss-animate-utils and 16 require @jasperquinn/postcss-motion-helpers. Checking the registry metadata for all 29 packages shows that 12 of the 17 npm publisher accounts published an exact pair of packages on the same day, with one package wired to @aaron205whitmore/postcss-animate-utils and its twin wired to @jasperquinn/postcss-motion-helpers:

npm publisher account	Package requiring `@aaron205whitmore/postcss-animate-utils`	Package requiring `@jasperquinn/postcss-motion-helpers`	Publication date(s)
`cypherbyte`	`animatecss-tailwind-vectrix` (`2.0.6`, `2.0.7`)	`animatecss-tailwind-luminary` (`2.0.6`, `2.0.7`)	2026-09-28
`enterprise0908`	`animate-twcss-bridge` (`2.0.6`)	`animate-twcss-pack` (`2.0.6`)	2026-09-28
`scott-rogers`	`signalledger-diagnostics` (`2.0.6`)	`signalledger-bridge` (`2.0.6`)	2026-09-28
`hackson306623`	`tailwindcss-keyframe-kit` (`3.0.0` to `3.0.2`)	`tailwindcss-animate-catalog` (`2.0.6`, `2.0.7`)	2026-09-28
`hannahgibbs`	`animatecss-tailwind-plugin` (`2.0.6`)	`animatecss-tailwind-helper` (`2.0.6`)	2026-09-28
`doublekk61`	`tailwindcss-animatemotion` (`1.0.7`)	`tailwindcss-motionanimate` (`1.0.1`)	2026-09-28
`adriannamrr`	`tailwind-keyframes` (`2.0.6`)	`tailwind-animationlab` (`2.0.6`)	2026-09-28
`johnxia1997`	`tailwind-fabric` (`3.0.1`, `3.0.4`)	`animate-tailwind-kit` (`3.0.1`, `3.0.4`)	2026-09-28 to 09-29
`keinsell-jh`	`tailwind-kinetic` (`2.0.6`, `2.0.8`)	`tailwind-animate-kit` (`2.0.6` to `2.0.8`)	2026-09-28 to 09-29
`killerdev1127`	`tailwind-animaflow-kit` (`2.0.6`)	`tailwind-animatecss-kit` (`2.0.6`)	2026-09-28
`jamesvectorpack`	`animatecss-tailwind-graphic` (`2.0.6`)	`animatecss-tailwind-binary` (`2.0.6`)	2026-09-28
`johnsmith0821`	`tailwindcss-effect-lab` (`0.0.0-stage`, `1.6.7`)	`tailwindcss-visual-kit` (`0.0.0-stage`, `1.3.6`)	2026-10-09

The remaining five accounts published a single package each: grant587holloway (animatecss-tailwind-adapter, 28 July), bennetwild (animatecss-tailwind-bridge, 13 September), ares0320 (tailwind-animatecss-uniform, 28 September), kinsley_badu (tailwind-css-keyframes, 28 September), and elony16 (animatecss-tailwind-presets, 29 September).

Affected packages inventory

The table below lists all 29 public npm packages and the 2 private scoped dependencies, verified against registry.npmjs.org on 22 October 2026:

Ecosystem	Package	Malicious versions	First seen	Status (22 Oct 2026)	Sources
npm	`animatecss-tailwind-adapter`	`2.0.6`	2026-07-28	Replaced by `0.0.1-security` (20 Oct 2026)	OpenSSF #1605, pkgwarden, npm registry
npm	`animatecss-tailwind-bridge`	`2.0.6` (`*` in GHSA)	2026-09-13	Replaced by `0.0.1-security` (20 Oct 2026)	GHSA-3h7p-p7hr-fqf7, OpenSSF #1605, pkgwarden
npm	`tailwind-animatecss-uniform`	`2.0.7` (`*` in GHSA)	2026-09-28	Replaced by `0.0.1-security` (9 Oct 2026)	GHSA-hxvr-77vv-6r85, OpenSSF #1605, pkgwarden
npm	`animate-tailwind-kit`	`3.0.1`, `3.0.4`	2026-09-28	Live on npm (`latest: 3.0.4`)	GHSA-q29m-3m5r-fmjj, pkgwarden, DependencyWatch
npm	`animate-twcss-bridge`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-v2vq-rvhc-qqr9, pkgwarden, DependencyWatch
npm	`animate-twcss-pack`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-jr8w-9rvh-vv8p, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-binary`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-5fhm-3gq2-6gj8, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-graphic`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-mp8w-g7p9-w5v3, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-helper`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-8rrv-xcpx-rv3r, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-luminary`	`2.0.6`, `2.0.7`	2026-09-28	Live on npm (`latest: 2.0.7`)	GHSA-vj87-h2x3-2985, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-plugin`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-gqf2-w3vm-g87w, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-presets`	`1.0.0`, `2.0.3`	2026-09-29	Live on npm (`latest: 2.0.3`)	GHSA-gh2v-353h-8jhq, pkgwarden, DependencyWatch
npm	`animatecss-tailwind-vectrix`	`2.0.6`, `2.0.7`	2026-09-28	Live on npm (`latest: 2.0.7`)	GHSA-hcfv-m7w3-vcch, pkgwarden, DependencyWatch
npm	`signalledger-bridge`	`2.0.6`, `2.0.8`	2026-09-28	Live on npm (`latest: 2.0.8` rotated to `@nexlayerlabs` on 30 Oct)	GHSA-h368-qgvj-jhgw, OpenSSF #1694, pkgwarden
npm	`signalledger-diagnostics`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-q9pp-3583-37vv, pkgwarden, DependencyWatch
npm	`tailwind-animaflow-kit`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-2hh6-9wwc-7j9w, pkgwarden, DependencyWatch
npm	`tailwind-animate-kit`	`2.0.6` (clean stub), `2.0.7`, `2.0.8`	2026-09-28	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-pvxf-hc22-hp2x, GHSA-w9j6-p46m-xvp4, pkgwarden
npm	`tailwind-animatecss-kit`	`2.0.6`	2026-09-28	Live on npm (`latest: 2.0.6`)	GHSA-q56v-wqww-c9pm, pkgwarden, DependencyWatch
npm	`tailwind-animationlab`	`2.0.6`	2026-09-28	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-wrp2-f9jg-g5qx, GHSA-7cm4-74gj-gfp2, pkgwarden
npm	`tailwind-css-keyframes`	`1.0.7`	2026-09-28	Live on npm (`latest: 1.0.7`)	GHSA-qpfh-v8qh-gq5m, pkgwarden, DependencyWatch
npm	`tailwind-fabric`	`3.0.1`, `3.0.4`	2026-09-28	Live on npm (`latest: 3.0.4`)	GHSA-jm3w-rxjc-9rp6, pkgwarden, DependencyWatch
npm	`tailwind-keyframes`	`2.0.6`	2026-09-28	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-94m4-x888-pgf4, GHSA-vh6h-8m24-j9mj, pkgwarden
npm	`tailwind-kinetic`	`2.0.6` (clean stub), `2.0.8`	2026-09-28	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-h6pg-m44p-2x74, GHSA-j2r4-xxhh-xx58, pkgwarden
npm	`tailwindcss-animate-catalog`	`2.0.6`, `2.0.7`	2026-09-28	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-6hg9-v89p-9w82, GHSA-4mf5-57pc-vj85, pkgwarden
npm	`tailwindcss-animatemotion`	`1.0.7`	2026-09-28	Live on npm (`latest: 1.0.7`)	GHSA-jfww-6c2q-w9rr, pkgwarden, DependencyWatch
npm	`tailwindcss-effect-lab`	`0.0.0-stage` (stub), `1.6.7`	2026-10-09	Live on npm (`latest: 1.6.7`)	GHSA-259h-r4vh-ph5j, pkgwarden, DependencyWatch
npm	`tailwindcss-keyframe-kit`	`3.0.0`, `3.0.1`, `3.0.2`	2026-09-28	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-8vv2-m423-rcx4, GHSA-282x-w96h-wv7f, pkgwarden
npm	`tailwindcss-motionanimate`	`1.0.1`	2026-09-28	Live on npm (`latest: 1.0.1`)	GHSA-jqm8-4v5f-g79x, pkgwarden, DependencyWatch
npm	`tailwindcss-visual-kit`	`0.0.0-stage` (stub), `1.3.6`, `1.3.7`	2026-10-09	Live on npm (`latest: 1.3.7` rotated to `@nexlayerlabs` on 29 Oct)	GHSA-m8c8-f5hx-664g, OpenSSF #1694, pkgwarden
npm	`tailwind-base-buttons`	`0.1.0` (`>= 0` in GHSA)	2026-10-12	Replaced by `0.0.1-security` (25 Oct 2026)	GHSA-5j43-343m-gggg, npm registry
npm	`animatecss-tailwind-keyframes`	`1.0.0`, `2.0.2`	2026-10-23	Live on npm (`latest: 2.0.2`, requires `@aaron205whitmore/postcss-animate-utils`)	OpenSSF #1694, npm registry
npm	`tailwind-kinetics`	`2.0.7`	2026-10-23	Live on npm (`latest: 2.0.7`, requires `@aaron205whitmore/postcss-animate-utils`)	OpenSSF #1694, npm registry
npm	`tailwind-kinetix`	`2.0.7`	2026-10-23	Live on npm (`latest: 2.0.7`, requires `@jasperquinn/postcss-motion-helpers`)	OpenSSF #1694, npm registry
npm	`noelc-css-blender`	`1.0.0`, `1.1.0`, `2.2.0`, `2.2.1`, `2.1.9`, `2.1.10`, `2.1.11`	2026-10-24	Replaced by `0.0.1-security` (24 Oct 2026)	GHSA-cj2x-975v-jmwf, npm registry
npm	`tailwindcss-theme-kit`	`*` (`>= 0` in GHSA)	2026-10-24	Replaced by `0.0.1-security` (24 Oct 2026)	GHSA-v5xr-xjx7-ggwf, npm registry
npm	`birch-css-utils`	`1.1.0`, `1.2.2` (`>= 0` in GHSA)	2026-10-26	Replaced by `0.0.1-security` (26 Oct 2026)	GHSA-p597-2ggw-c82r, OpenSSF #1666
npm	`harlow-css-mixer`	`*` (`>= 0` in GHSA)	2026-10-26	Replaced by `0.0.1-security` (26 Oct 2026)	GHSA-j658-c56g-qxh4, npm registry
npm	`postcss-semantic-themes`	`*` (`>= 0` in GHSA)	2026-10-26	Replaced by `0.0.1-security` (26 Oct 2026)	GHSA-fh55-fq5h-h352, npm registry
npm	`motion-helpers-compat`	`1.3.7`, `1.3.8`	2026-10-26	Live on npm (`latest: 1.3.8`, requires `@jasperquinn/postcss-motion-helpers`)	OpenSSF #1694, npm registry
npm	`tw-motion-css`	`2.0.2`	2026-10-30	Live on npm (`latest: 2.0.2`, requires `@codentra/postcss-kinetix`)	OpenSSF #1694, npm registry
npm	`tailwindcss-animate-bridge`	`2.0.8`	2026-10-30	Live on npm (`latest: 2.0.8`, requires `@utilitycraft/tailwindcss-motion-atelier` in `lib/catalog/source.js:5`)	OpenSSF #1694, npm registry
npm	`fast-deep-thinking`	`1.0.1`	2026-10-30	Live on npm (`latest: 1.0.1`, requires `@claudeorg/universal-code-generator`)	OpenSSF #1694, npm registry
npm	`framer-motionanimate`	`14.7.2`	2026-10-30	Live on npm (`latest: 14.7.2`, requires `@doublekk61_pro/postcss-motion-animation`)	OpenSSF #1694, npm registry
npm	`@aaron205whitmore/postcss-animate-utils`	`^1.0.1` (private payload)	2026-07-28	Private scope (`404` without lure `.npmrc` token)	OpenSSF #1605, pkgwarden, DependencyWatch
npm	`@jasperquinn/postcss-motion-helpers`	`^1.0.1` (private payload)	2026-09-13	Replaced by `0.0.1-security` (29 Oct 2026)	GHSA-88vx-c9pj-9527, OpenSSF #1605, pkgwarden
npm	`@nexlayerlabs/postcss-keyframe-utils`, `@claudeorg/universal-code-generator`, `@doublekk61_pro/postcss-motion-animation`, `@utilitycraft/tailwindcss-motion-atelier`, `@codentra/postcss-kinetix`	Private payloads	2026-10-29 to 2026-10-30	Private scopes (`404` without lure `.npmrc` token)	OpenSSF #1694

IOCs

Lure domains and repositories:
- nodveta[.]com (registered 30 June 2026) and private GitHub repository Nodveta-Infra/backend-engineer-assessment (advertised via torre[.]ai/s/dphYpcyPn1)
- blockroutelabs[.]com (“BlockRoute Labs” Solana copy-trading dashboard assessment on Djinni.co using animatecss-tailwind-bridge@2.0.6)
- Non-existent GitHub author/repo URLs in package metadata: github[.]com/sericpieap/*
Private npm payload scopes:
- @aaron205whitmore/postcss-animate-utils (^1.0.1)
- @jasperquinn/postcss-motion-helpers (^1.0.1, replaced by 0.0.1-security on 29 Oct 2026)
- @nexlayerlabs/postcss-keyframe-utils (introduced 29 Oct 2026 in tailwindcss-visual-kit@1.3.7 and signalledger-bridge@2.0.8)
- @codentra/postcss-kinetix (introduced 30 Oct 2026 in tw-motion-css@2.0.2)
- @utilitycraft/tailwindcss-motion-atelier (introduced 30 Oct 2026 in tailwindcss-animate-bridge@2.0.8)
- @claudeorg/universal-code-generator (introduced 30 Oct 2026 in fast-deep-thinking@1.0.1)
- @doublekk61_pro/postcss-motion-animation (introduced 30 Oct 2026 in framer-motionanimate@14.7.2)
Representative artifact SHA-256 digests:
- animate-twcss-bridge-2.0.6.tgz: 5945136df8a863e12eb0a3f1f72fe6cb19a51b1f51344346e50398fd5d2fbaf2
- animate-twcss-bridge@2.0.6 package/src/motion.js (@aaron205whitmore template): 57570aa9b61e15c73a9b73d4a5175c61326b176743313b1e604ddba5e900b98f
- animate-twcss-pack-2.0.6.tgz: e83b87c4b8be50e081710c1aaf45486e35aadb2d8a0170e1ee6a6c7a63f62efc
- animate-twcss-pack@2.0.6 package/src/motion.js (@jasperquinn template): 6ee056981639f1a151ea9d665d37b1a926e0bc0595e8970968eef243a9e87617
- tailwind-animatecss-uniform-2.0.7.tgz (recorded before takedown): 39ef484ae5c73a007433bc3366d9fe6c0354d2854b1b9424e1e0291894e7a44d
- animatecss-tailwind-bridge-2.0.6.tgz (recorded before takedown): 577f09b61d994cab3e83d6c71e4eed7df7995b718367780f11b4482041095367

Detection and remediation

Search developer workstations and repositories for any of the 43 public plugin names, the seven private scopes, or a committed .npmrc containing an _authToken in a cloned project:

# Search manifests, lockfiles, and Tailwind configs for the 43 public packages and 7 private scopes
rg -n '(@aaron205whitmore/postcss-animate-utils|@jasperquinn/postcss-motion-helpers|@nexlayerlabs/postcss-keyframe-utils|@claudeorg/universal-code-generator|@doublekk61_pro/postcss-motion-animation|@utilitycraft/tailwindcss-motion-atelier|@codentra/postcss-kinetix|noelc-css-blender|birch-css-utils|harlow-css-mixer|postcss-semantic-themes|motion-helpers-compat|tw-motion-css|fast-deep-thinking|framer-motionanimate|animatecss-tailwind-(adapter|bridge|binary|graphic|helper|keyframes|luminary|plugin|presets|vectrix)|animate-(tailwind-kit|twcss-bridge|twcss-pack)|signalledger-(bridge|diagnostics)|tailwind-(animaflow-kit|animate-kit|animatecss-kit|animatecss-uniform|animationlab|base-buttons|css-keyframes|fabric|keyframes|kinetic|kinetics|kinetix)|tailwindcss-(animate-bridge|animate-catalog|animatemotion|effect-lab|keyframe-kit|motionanimate|theme-kit|visual-kit))' \
  package.json package-lock.json pnpm-lock.yaml yarn.lock bun.lock tailwind.config.* 2>/dev/null

# Check installed node_modules trees
npm ls @aaron205whitmore/postcss-animate-utils @jasperquinn/postcss-motion-helpers @nexlayerlabs/postcss-keyframe-utils @claudeorg/universal-code-generator @doublekk61_pro/postcss-motion-animation @utilitycraft/tailwindcss-motion-atelier @codentra/postcss-kinetix 2>/dev/null || true

# Hunt for repo-local .npmrc files with hardcoded registry tokens (the lure signature)
rg -n '//registry\.npmjs\.org/:_authToken=' --glob '*.npmrc' . 2>/dev/null

If any host cloned one of the assessment repositories or installed either private scope:

Assume full workstation compromise. Because the private scoped package executes inside the local Node.js development server when tailwind.config.js loads, it runs with the developer’s full OS account access. Isolate the machine and rebuild it from a clean image.
Rotate every credential present on the workstation: SSH keys, GitHub/GitLab tokens, npm and PyPI publishing tokens, AWS/GCP/Azure CLI credentials, browser-stored passwords and session cookies, cryptocurrency wallet keys, and AI coding assistant keys (~/.claude, Cursor, Windsurf, OpenAI, Anthropic).
Never run take-home interview repositories on a machine that holds credentials, and do not point a local AI coding agent (Claude Code, Cursor, OpenCode) at an unfamiliar repository before inspecting .npmrc, .vscode/tasks.json, AGENTS.md, and CLAUDE.md.

Timeline

2026-06-30: Lure domain nodveta[.]com is registered.
2026-07-28: First package in the cluster, animatecss-tailwind-adapter@2.0.6, is published to npm by grant587holloway requiring @aaron205whitmore/postcss-animate-utils.
2026-09-13: animatecss-tailwind-bridge@2.0.6 is published by bennetwild requiring @jasperquinn/postcss-motion-helpers.
2026-09-28 to 2026-09-29: 25 additional Tailwind/Animate.css plugin packages are published across 14 npm accounts (cypherbyte, enterprise0908, scott-rogers, hackson306623, hannahgibbs, doublekk61, adriannamrr, johnxia1997, keinsell-jh, killerdev1127, jamesvectorpack, ares0320, kinsley_badu, and elony16). The Nodveta-Infra GitHub organization is created on 29 September with backdated commits from 20 and 21 September.
2026-10-07 to 2026-10-08: Researcher Yunus Aydın (juanda2222) submits OpenSSF malicious-packages PR #1605 documenting the first three packages and the Torre.ai / Djinni.co fake-interview lures.
2026-10-09: npm replaces tailwind-animatecss-uniform with 0.0.1-security. The same day, johnsmith0821 publishes two more packages in the family (tailwindcss-effect-lab@1.6.7 and tailwindcss-visual-kit@1.3.6).
2026-10-16: pkgwarden publishes its analysis linking all 29 packages across the @aaron205whitmore and @jasperquinn private scopes.
2026-10-20: GitHub Advisory Database ingests 26 advisories (GHSA-q29m-3m5r-fmjj through GHSA-m8c8-f5hx-664g), and npm replaces animatecss-tailwind-adapter and animatecss-tailwind-bridge with 0.0.1-security.
2026-10-22: Registry verification confirms that 26 of the 29 public packages remain live on registry.npmjs.org.
2026-10-24 to 2026-10-25: noelc-css-blender publishes seven versions (1.0.0 to 2.1.11) before npm replaces noelc-css-blender, tailwindcss-theme-kit, and tailwind-base-buttons with 0.0.1-security (GHSA-cj2x-975v-jmwf, GHSA-v5xr-xjx7-ggwf, and GHSA-5j43-343m-gggg).
2026-10-26: npm replaces birch-css-utils, harlow-css-mixer, and postcss-semantic-themes with 0.0.1-security (GHSA-p597-2ggw-c82r, GHSA-j658-c56g-qxh4, GHSA-fh55-fq5h-h352).
2026-10-29 (14:49 to 15:17 UTC): npm replaces @jasperquinn/postcss-motion-helpers (GHSA-88vx-c9pj-9527) and six public packages (tailwindcss-keyframe-kit, tailwindcss-animate-catalog, tailwind-animationlab, tailwind-keyframes, tailwind-animate-kit, and tailwind-kinetic) with 0.0.1-security placeholders.
2026-10-29 (20:25 UTC) to 2026-10-30 (08:45 UTC): Operators rotate to five new private scopes (@nexlayerlabs/postcss-keyframe-utils, @codentra/postcss-kinetix, @utilitycraft/tailwindcss-motion-atelier, @claudeorg/universal-code-generator, and @doublekk61_pro/postcss-motion-animation), update tailwindcss-visual-kit (1.3.7) and signalledger-bridge (2.0.8), and publish four new public packages (tw-motion-css, tailwindcss-animate-bridge, fast-deep-thinking, and framer-motionanimate), documented alongside four earlier October packages in OpenSSF PR #1694.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Explore secrets scanning Get Demo