The npm package tailwind-fabric versions 3.0.1 and 3.0.4 is associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded. The payload resides in a private scoped package that requires an npm token to access, preventing direct retrieval from the public registry. The publicly published tarball contains no install scripts or network code, and no direct malicious behavior was observed in the examined package code paths. Multiple related packages were published under various accounts over a period of months.