The npm package tailwind-keyframes version 2.0.6 is associated with a malicious campaign involving a private dependency that delivers malicious code when the plugin is loaded. Although the public package tarball contains no install scripts or network code, the payload resides in a private scoped package that requires an npm token to access. This package is part of a broader campaign with multiple malicious packages published under various accounts between July and October 2026. Installing or running this package may lead to full system compromise.