postcss-theme-provider
This report shows the evidence for postcss-theme-provider@1.0.4. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13518 confirms this npm version as malicious.
Advisory
MAL-2026-13518
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in postcss-theme-provider (npm)
Details
packages/core/src/index.ts and plugin.ts (compiled into dist/index.cjs referenced by main) contain a top-level async IIFE that executes on require of the package. The loader queries public Ethereum RPC endpoints (eth-mainnet.public.blastapi.io, eth.blockscout.com) for the latest transaction from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f01210063e9aDC2490Ef1a), decodes two IPv4 addresses from the transaction's `to` field bytes, fetches XOR-encrypted JavaScript from http://<ip>:443/0x/cls and /0x/ls, decrypts it, calls eval on the result, and spawns a detached `node -e <payload>` child process via child_process.spawn with `unref()`. Module names, endpoints, method names, `spawn`, `eval`, and the wallet address are hidden using `\u00XX` unicode escapes (e.g. `require("\u0068\u0074\u0074\u0070")`, `require("\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073")`) while legitimate PostCSS code in the same file uses normal string literals. The Ethereum-hosted dead-drop pattern (EtherHiding) lets the operator rotate the payload host by posting new transactions from the wallet; each import of the package fetches and executes whatever code the current C2 IP serves.
## Source: ghsa-malware (937f6ec3983bfe798ac6f21a95990720430b5a41f3629f9a408c48c765ab0dfa) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The dynamic-import hint is attributable to the user-invoked CLI loading local configuration. No install-time execution or concrete malicious behavior is present.
Static reason
No blocking static signals were detected.
Trigger
User imports the PostCSS plugin or explicitly runs the theme CLI.
Impact
Expected project-local CSS, documentation, JSON, and TypeScript output only.
Mechanism
Local theme parsing and artifact generation.
AI rationale
The dynamic-import hint is attributable to the user-invoked CLI loading local configuration. No install-time execution or concrete malicious behavior is present.
Evidence
package.jsondist/index.cjsdist/index.jsdist/cli.js
Independent scan evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install lifecycle hook; prepublishOnly references an absent script.
- dist/index.cjs is a PostCSS theme parser/compiler with local artifact writing.
- dist/cli.js only reads project theme/config files and writes generated CSS/docs/JSON/types on explicit CLI commands.
- No network, subprocess, eval, credential/env harvesting, or persistence APIs found in executable JS.
- Dynamic import in dist/cli.js loads a user-selected local theme config only when the CLI runs.
Behavioral surface
ChildProcessCryptoDynamicRequireFilesystem
HighEntropyStrings
Source & flagged code
1 flagged · loading sourcedist/index.cjsView file
4L5: var promises = require('fs/promises');
L6: var path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.cjsView on unpkg · L4Findings
1 Medium4 Low
MediumDynamic Requiredist/index.cjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to postcss-theme-provider@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing postcss-theme-provider@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.