A malicious package impersonating the legitimate better-tailwindcss npm project was published under the same name. This fake package declares dependencies resolved from an untrusted, plain-HTTP source without integrity verification, causing npm to fetch and execute arbitrary code during installation. The code is unrelated to the real project and is labeled as for 'Security Research Testing Purpose,' indicating namespace squatting and malicious intent.