registry / postcss-initialize-plugin / 3.0.4

postcss-initialize-plugin@3.0.4

PostCSS plugin to fallback initial keyword.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Initializing this PostCSS plugin activates an obfuscated payload chain. It retrieves blockchain-derived data and executes it locally.

Static reason

One or more suspicious static signals were detected.

Trigger

User configuration/build invokes the postcss-initial plugin factory.

Impact

Arbitrary code execution in the build user's environment.

Mechanism

obfuscated network payload retrieval followed by eval and detached child-process execution

Attack narrative

The injected code runs inside the exported plugin factory, reads an optional RPC endpoint, queries Ethereum-related endpoints, derives further network targets from returned transaction data, and fetches an encoded payload. It XOR-decodes that response before passing it to eval and a detached Node child process. This behavior is unrelated to CSS fallback generation and enables remote-controlled execution when the plugin is initialized.

Rationale

The package contains concrete obfuscated, runtime network-to-eval-and-spawn behavior unrelated to its declared PostCSS purpose. No lifecycle hook is needed because the payload executes when consumers initialize the plugin.

Evidence

index.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postcss-initialize-plugin@3.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code