The npm package animatecss-tailwind-graphic version 2.0.6 is linked to a malicious campaign involving fake job interviews. It depends on a private scoped package that is not publicly accessible and requires an npm token found in a lure repository, enabling execution of hidden code when the plugin is loaded in Tailwind CSS. The public tarball itself contains no install scripts or network code, and no direct harmful behavior was observed in the shipped package contents. Multiple similar packages were published under various accounts over a period of months.