The npm package signalledger-diagnostics version 2.0.6 is identified as part of a malicious campaign involving fake job interview lures. The package is a Tailwind CSS plugin that depends on a private scoped package requiring an npm token, which delivers the actual malicious payload when the plugin is loaded during development. The publicly available tarball does not contain install scripts or network code, and no direct malicious behavior was observed in the shipped files. Multiple similar packages were published under various accounts over a period of months.