@ornikar/postcss-config@9.1.7

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Installing @ornikar/postcss-config@9.1.7

Arbitrary code execution and likely credential theft on the install host.

preinstall downloader executes obfuscated payload with remote eval

The preinstall hook invokes setup.mjs, which obtains a Bun binary, then executes math_init.js. The bundled payload is heavily obfuscated and contains an eval of fetched response text, subprocess/filesystem behavior, and GitHub-token-oriented logic. This creates unconsented install-time remote code execution unrelated to the package's advertised PostCSS configuration.

Source inspection confirms an install-triggered downloader/executor chain leading to an obfuscated remote-eval payload. This is concrete malicious behavior, not a noisy static signal.