MAL-2026-14261
Malicious code in postcss-initialize-provider (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16) postcss-initialize-provider@3.0.4 presents itself as a PostCSS plugin (README, badges, and repository links reference the legitimate maximkoretskiy/postcss-initial project), but index.js contains a heavily obfuscated payload (obfuscator.io-style 244-entry string array with rotation and _0x-prefixed identifiers) appended to the plugin code. Decoded strings show the payload captures require and module onto the global object (global['r']=require, global['m']=module), imports http/https/zlib/child_process, and queries Ethereum RPC and block-explorer endpoints (drpc.org, blockscout.com/api, stapi.io, with eth_getBlockByNumber / eth_getTransactionCount / module=account&action=txlist calls) to retrieve attacker-controlled data staged on-chain, then executes it via child_process.spawn and the captured require handle. A CSS transformation plugin has no legitimate need for child_process, Ethereum RPC access, or global capture of require/module. The package name typosquats postcss-initial and reuses that project's presentation to distribute the loader.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for postcss-initialize-provider (npm). Pin to a known-safe version or switch to an alternative.