The npm package animate-twcss-bridge version 2.0.6 is identified as malicious and linked to a fake job interview campaign. It depends on a private scoped package that requires an npm token to resolve, which can execute code when the Tailwind CSS plugin loads. The publicly available tarball does not contain install scripts or network code, and the malicious payload resides in the private dependency. Multiple related malicious packages were published under various accounts over a period of months. No direct lifecycle script execution or network communication is present in the shipped contents.