The tailwindcss-visual-kit npm package versions 0.0.0-stage and 1.3.6 are associated with a malicious campaign involving a private dependency that executes code when the plugin is loaded. The malicious payload resides in a private scoped package that requires an npm token to access and is not present in the public registry. The publicly available package tarball contains no install scripts or network code, and no direct supply-chain attack behavior was observed in the analyzed package contents. Multiple related packages were published under various accounts over several months.