The animatecss-tailwind-vectrix npm package versions 2.0.6 and 2.0.7 are part of a malicious campaign involving fake job interview lures. The package depends on a private scoped package that requires an npm token to access, which can execute code when the Tailwind CSS plugin loads during development server startup. The public tarball itself contains no install scripts or network code, and the private dependency was not retrieved for analysis. Multiple related malicious packages were published under various accounts between July and October 2026.