The tailwindcss-animate-catalog npm package versions 2.0.6 and 2.0.7 are part of a malicious campaign involving fake job interview lures. The package itself appears benign with no direct malicious code in its public tarball, but it depends on a private scoped package that requires an npm token embedded in the lure repository. This private dependency likely delivers the malicious payload when the plugin is loaded during development. Installing or running this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.