The npm package tailwind-kinetic versions 2.0.6 and 2.0.8 are part of a malicious campaign linked to fake job interviews. The package itself contains no direct install scripts or network code, but it depends on a private scoped package that requires an npm token embedded in a lure repository. This private dependency executes code when the plugin is loaded, potentially compromising the host system. Multiple related malicious packages were published over several months. Although the shipped package content does not show typical supply-chain attack fingerprints, any system with this package installed should be considered fully compromised.