Malicious code in tailwindcss-animatemotion (npm)

tailwindcss-animatemotion 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious Package

Overview tailwindcss-animatemotion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in tailwindcss-animatemotion (npm)

tailwindcss-animatemotion 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

MAL-2026-18086 Malicious code in tailwindcss-animatemotion (npm)

tailwindcss-animatemotion 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute...

RUSTSEC-2021-0158 XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute...

PT-2021-31151

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute...

ZDI-08-006: Microsoft Internet Explorer SVG animateMotion.by Code Execution Vulnerability

ZDI-08-006: Microsoft Internet Explorer SVG animateMotion.by Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-006.html February 12, 2008 -- CVE ID: CVE-2008-077 -- Affected Vendor: Microsoft -- Affected Products: Internet Explorer 6 Internet Explorer 7 --...

PT-2008-1733 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 SP1 through 7 Description: A use-after-free issue allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, such as the by property of an animateMotion SVG...

CVE-2008-0077: Use After Free

Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, as demonstrated using the by property of an animateMotion SVG element, aka "Property Memory Corruption...