The signalledger-bridge npm package version 2.0.6 is associated with a malicious campaign involving fake job interview lures. The package itself contains no install scripts or network code, but it depends on a private scoped package that delivers the malicious payload when the plugin is loaded in Tailwind CSS. The private dependency is not publicly accessible and requires an npm token, which was exposed in the lure repository. Multiple related malicious packages were published over several months under different accounts.