The animate-tailwind-kit npm package versions 3.0.1 and 3.0.4 are linked to a malicious campaign involving a private dependency that delivers malicious code when the plugin is loaded in Tailwind CSS configurations. The public package itself contains no installer scripts or network code, but it requires a private scoped package that is not publicly accessible and relies on an npm token committed in a lure repository. This private dependency executes code during development server startup. Multiple related malicious packages were published over several months under various accounts.