The npm package tailwindcss-effect-lab versions 0.0.0-stage and 1.6.7 is associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded. The payload resides in a private scoped package that requires an npm token to access, preventing public retrieval of the malicious code. The publicly available tarball does not contain install scripts or network code. Multiple related packages were published under different accounts over several months. An Amazon Inspector analysis found no evidence of typical supply-chain attack behaviors such as network activity or credential theft in the examined package.