postcss-initial-provider@3.0.4

index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints (1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io, eth.blockscout.com/api) for the latest transaction of the hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, parses the destination-address bytes of that transaction as two IPv4 addresses, fetches an XOR-encrypted payload from those hosts over HTTP, decrypts it, and executes it both via in-process eval() and via a detached spawn('node', ['-e', <payload>]). Every sensitive string (module names http/https/child_process, HTTP method, paths /0x/cls and /0x/ls, wallet address, RPC hostnames, header x-payload-b64) is hidden via \uXXXX escapes to evade tarball string scans. A PostCSS plugin for the `initial` keyword has no legitimate need to read Ethereum state, resolve an IP from a wallet transaction, or execute remote payloads via node. This is a supply-chain compromise: any installer that requires this package receives arbitrary attacker-controlled code execution on their host, with the C2 rendezvous point rotatable by the attacker via a new on-chain transaction.