Malicious npm package in a Next.js repo ran on every npm run dev

A developer found a private npm package with ~180 KB of obfuscated JavaScript in a Fiverr-delivered Next.js project, executing on every dev-server start. The attack bypassed --ignore-scripts because the malicious require() sat in tailwind.config.js and ran during CSS generation.

• The repo shipped an .npmrc with an npm auth token granting access to a private package
• tailwind-animationlab@2.0.6 mimicked tailwindcss plugins and depended on a private package
• Only .npmrc, tailwind.config.js and package.json were edited separately from the rest
• ignore-scripts would not help: the require() in the Tailwind config runs at build time