The npm package tailwind-animatecss-kit version 2.0.6 is associated with a malicious campaign involving fake job interviews. It includes a private scoped dependency that requires an npm token to resolve, enabling code execution when the plugin is loaded in tailwind.config.js and the development server starts. The public tarball itself contains no install scripts or network code, and no direct harmful code paths were identified in the shipped contents. Multiple similar packages were published under various accounts during mid-2026.