The tailwind-css-keyframes package version 1.0.7 is identified as malicious, associated with a fake job interview campaign. It includes a private scoped dependency that requires an npm token to access, which can execute code when the plugin is loaded in tailwind.config.js and the development server starts. The public tarball itself contains no install scripts or network code, and the malicious payload resides in the private dependency. Multiple related malicious packages were published over a period from July to October 2026. No install-time or import-time network activity, credential access, or obfuscated payloads were observed in the public package.