Clean-Looking Next.js Repo Hid Malware Triggered by npm run dev

A developer who received a Next.js invoice app from a Fiverr seller found that it concealed malicious code that would execute each time the dev server started. The project's .npmrc contained an npm auth token that gave access to a private package holding about 180 KB of obfuscated JavaScript, pulled in through a lookalike Tailwind plugin named tailwind-animationlab. Several suspicious config files had been modified on a different date from the rest of the project, and the plugin's registry metadata suggested it was created recently to match an existing version constraint. Standard code search found nothing suspicious, since the payload was not stored in the repository itself. The developer examined the package without running it and reported the findings.