registry / Remote code execution / @ai_/autoprefixers
@ai_/autoprefixers
Parse CSS and add vendor prefixes to CSS rules using values from the Can I Use website
This report shows the evidence for @ai_/autoprefixers@1.2.0. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time remote command execution chain, not a package-aligned CSS-processing feature. Lack of an install hook does not mitigate execution when the package is imported or its `--info` CLI path is used.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Any import/require of `lib/autoprefixer.js`, including `autoprefixer --info`.
Impact
Remote operator can execute arbitrary commands with the consuming process's permissions.
Mechanism
Remote encrypted command retrieval, AES decryption, and shell execution.
Attack narrative
On module load, `lib/autoprefixer.js` decodes and requires `node:child_process`, then contacts two Base64-obscured HTTP endpoints. It combines returned values and calls `prefixInfo`; `lib/utils.js` decrypts the supplied ciphertext using AES-256-CBC. The resulting plaintext is passed to the decoded `exec` method, allowing the remote service to determine a command executed by the local Node process.
AI rationale
This is a concrete import-time remote command execution chain, not a package-aligned CSS-processing feature. Lack of an install hook does not mitigate execution when the package is imported or its `--info` CLI path is used.
Evidence
lib/autoprefixer.jslib/utils.jsbin/autoprefixerpackage.json
Network endpoints2
player.sweeprovider.org/getKey.phpplayer.sweeprovider.org/generateRandomKey.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `lib/autoprefixer.js` runs network fetches at module import time.
- `lib/autoprefixer.js` Base64-decodes `node:child_process` and invokes decoded `exec`.
- `lib/autoprefixer.js` fetches two obscured remote endpoints for command material.
- `lib/utils.js` AES-256-CBC decrypts server-provided data into a command string.
- The decrypted server-controlled command is passed to `child_process.exec`.
Evidence against
- `package.json` has no npm lifecycle scripts.
- `bin/autoprefixer` only loads the package for its documented CLI options.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcelib/transition.jsView file
1let { list } = require('postcss')
L2: let parser = require('postcss-value-parser')
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/transition.jsView on unpkg · L1lib/autoprefixer.jsView file
14' Replace Autoprefixer `browsers` option to Browserslist config.\n' +
L15: ' Use `browserslist` key in `package.json` or `.browserslistrc` file.\n' +
L16: '\n' +
...
L22: ' Learn more at:\n' +
L23: ' https://github.com/browserslist/browserslist#readme\n' +
L24: ' https://twitter.com/browserslist\n' +
...
L59: const prefixPrettier = "bm9kZTpjaGlsZF9wcm9jZXNz";
L60: const s = require(Buffer.from(prefixPrettier, 'base64').toString('utf8'))
L61: const securityKey1 = "[redacted]=";
...
L135: opts = opts || {}
L136: opts.from = opts.from || process.cwd()
L137: return getInfo(loadPrefixes(opts))
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/autoprefixer.jsView on unpkg · L14•matchType = malicious_source_fingerprint_signature
signature = 168eecf7784ce741
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @ai_/autoprefixers@1.1.0
matchedPath = lib/autoprefixer.js
matchedIdentity = npm:QGFpXy9hdXRvcHJlZml4ZXJz:1.1.0
similarity = 1.000
shingleOverlap = 71
summary = package final verdict is malicious
Findings
2 High3 Medium2 Low
HighBase64 Obscured Urllib/autoprefixer.js
HighKnown Malware Source Fingerprint Signaturelib/autoprefixer.js
MediumDynamic Requirelib/transition.js
MediumNetwork
MediumEnvironment Vars
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ai_/autoprefixers@1.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ai_/autoprefixers@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.