The tailwind-animate-kit npm package versions 2.0.6, 2.0.7, and 2.0.8 are part of a malicious campaign involving a private dependency that executes code when the plugin is loaded in tailwind.config.js. The malicious payload is hidden in a private scoped package that requires an npm token to resolve, enabling code execution during development server startup. The package tarballs themselves contain no install scripts or network code, making detection difficult. This campaign includes multiple malicious packages published under various accounts between July and October 2026. Systems with this package installed should be considered fully compromised.