registry / Remote code execution / post-css-transfer
post-css-transfer
Tool for transforming styles with JS plugins
This report shows the evidence for post-css-transfer@0.0.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a normal-looking PostCSS facade, but its import-time appended payload is an explicit remote loader and executor. The behavior is unrelated to the declared CSS transformation purpose.
Static reason
No blocking static signals were detected.
Trigger
A consumer require()s or imports the package main entrypoint.
Impact
Arbitrary attacker-supplied code execution in the importing user's environment, with persistence-like detached execution.
Mechanism
Import-time remote payload retrieval, XOR decoding, eval, and detached child-process execution.
Attack narrative
The main CommonJS module contains a concealed IIFE appended after its legitimate export. On import it queries Ethereum RPC/block-explorer services to locate transaction data, derives remote HTTP command hosts, retrieves XOR-obfuscated payloads, evaluates one payload, and runs another via a detached hidden Node child process. This is concrete, unconsented remote code execution.
AI rationale
The package has a normal-looking PostCSS facade, but its import-time appended payload is an explicit remote loader and executor. The behavior is unrelated to the declared CSS transformation purpose.
Evidence
package.jsonlib/postcss.jslib/postcss.mjs
Network endpoints5
eth.blockscout.com/api1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.io
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- lib/postcss.js:101 appends an immediately invoked async payload after the normal export.
- Importing the main entrypoint starts Ethereum RPC/block-explorer requests to derive command hosts.
- The payload XOR-decodes remote responses and executes one with eval().
- It spawns a detached, hidden node process to execute another decoded remote response.
- package.json has no lifecycle hook; execution occurs on ordinary require/import.
Evidence against
- The preceding lib/postcss.js implementation is normal PostCSS-compatible API code.
- No package lifecycle scripts are declared.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcelib/postcss.jsView file
100module.exports = postcss;
L101: global.i="A12-tet~~~1000n~~~";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0...
L102: postcss.default = postcss
High
100module.exports = postcss;
L101: global.i="A12-tet~~~1000n~~~";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0...
L102: postcss.default = postcss
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/postcss.jsView on unpkg · L100100module.exports = postcss;
L101: global.i="A12-tet~~~1000n~~~";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0...
L102: postcss.default = postcss
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/postcss.jsFindings
2 High1 Medium5 Low
HighChild Processlib/postcss.js
HighSame File Env Network Executionlib/postcss.js
MediumEnvironment Vars
LowScripts Present
LowEvallib/postcss.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to post-css-transfer@0.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing post-css-transfer@0.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.