MAL-2026-12418

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590) src/normalize-options.js is heavily obfuscated (RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison branches) while the rest of the package (index.js, plugin.js, root.js, declarations.js) is plain readable code. When the PostCSS plugin is instantiated (createPlugin -> normalizeOptions), the loader assembles an HTTPS URL from obfuscated string-array entries, appends keys from the caller-supplied options.features sub-object as query parameters, fetches a JSON response, base64-decodes its `message` field, and executes the decoded code with `new Function('require', code)(require)` — arbitrary code execution in every downstream consumer's build/CI process. The loader also writes a wrapper file to the OS tmpdir (named with process.pid) containing `require('<pkg>')(<options>); setInterval(()=>{},2147483647);` and spawns `process.execPath` detached with stdio ignored and env `LT1_STAGE1_CHILD=1`, then calls `child.unref()`. The detached node child re-enters the loader branch, decoupling the fetch-and-eval from the parent build and keeping it alive on a ~24.8-day interval after PostCSS exits, enabling persistent staging beyond the build window. Package metadata (name postcss-animate-css-vars, description 'PostCSS plugin for animate.css', author 'Alex Rivera <alex@cssanimation.dev>', homepage cssanimation.dev) presents as a legitimate PostCSS ecosystem plugin, but the shipped code contains no animate.css handling in the obfuscated loader path — the metadata is cover for the loader.