The npm package animatecss-tailwind-luminary versions 2.0.6 and 2.0.7 is associated with a malicious campaign involving multiple fake packages. The package itself contains no harmful install-time or import-time behavior, no lifecycle scripts, and no network calls. However, it depends on a private scoped package that is not publicly accessible and requires an npm token, which could deliver malicious code when the plugin is loaded in a development environment. This campaign includes multiple packages published under various accounts over a period of months.