The npm package tailwindcss-animatemotion version 1.0.7 is associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded in tailwind.config.js. The malicious payload resides in a private scoped package that requires an npm token to resolve, preventing public retrieval. The published package itself contains no install scripts or network code, and no direct malicious behavior was observed in the shipped files. Multiple related packages were published under various accounts over a period of months.