The npm package tailwindcss-motionanimate version 1.0.1 is identified as malicious. It is part of a fake job interview campaign involving multiple similar packages. The package itself contains no install-time execution, no lifecycle scripts, no network communication, and no observable malicious behavior in the published tarball. The malicious payload is hidden in a private scoped dependency that requires an npm token to access, which was not retrieved during analysis. Multiple related packages were published over a period of months by various accounts.