The npm package tailwind-animator-scroll version 1.7.0 contains malicious code embedded in its main entry point. The code uses obfuscated eval and base64 decoding to execute attacker-controlled payloads during the build process, exposing sensitive environment variables, CI tokens, source code, and credentials. The package impersonates a legitimate Tailwind CSS animation plugin via typosquatting and copied documentation to lure developers into installing it. Installation or use of this package compromises the host system, potentially allowing full attacker control.