Skip to content

2026-02-04 — NPM malware packages: dspmobile, tailwindcss-animation-modern

GitHub published malware advisories for the following NPM packages:

  • dspmobile (GHSA-x9fp-x6pr-v3wx)
  • tailwindcss-animation-modern (GHSA-w9j5-g394-3q5c)

Each advisory includes language equivalent to:

Any computer that has this package installed or running should be considered fully compromised.

What to do (defender-focused)

  1. Treat as an incident
  2. Assume compromise of the host(s) where the package was installed/built/run.

  3. Rotate all secrets that could have been present on the host (tokens, API keys, SSH keys, cloud creds) from a clean machine.

  4. Identify exposure

  5. Search for the package names in:
    • package.json
    • package-lock.json / yarn.lock / pnpm-lock.yaml
  6. Use npm ls <pkg> to identify whether it was a transitive dependency.

  7. Check CI runners as well as developer workstations (supply chain malware often triggers during installs/builds).

  8. Contain + eradicate

  9. Remove the package and revert lockfiles to a known-good commit.

  10. If this occurred on a developer workstation or CI runner, consider re-imaging rather than “cleaning”.

  11. Add guardrails

  12. Prefer lockfiles committed to source control.
  13. Consider npm --ignore-scripts where feasible (install scripts are a common malware execution vector).
  14. Enforce dependency policy checks in CI (allowlists/denylists, provenance, SCA).

References

  • GitHub advisory: https://github.com/advisories/GHSA-x9fp-x6pr-v3wx
  • GitHub advisory: https://github.com/advisories/GHSA-w9j5-g394-3q5c