The npm package tailwind-animaflow-kit version 2.0.6 is associated with a malicious campaign involving fake job interview lures. The package itself contains no install scripts or network code, but it requires a private scoped dependency that is inaccessible publicly and delivers the malicious payload when the plugin is loaded in tailwind.config.js. Multiple similar packages were published under different accounts over a short period in 2026.