postcss-animatecss

{"modified":"2026-07-14T04:33:47Z","published":"2026-07-14T03:37:23Z","schema_version":"1.7.4","id":"MAL-2026-10539","summary":"Malicious code in postcss-animatecss (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (adfcae16a606f0b7eccb6cd94c1d1d0b583b19021bb15d04161f3ca8855aba61)\nThe exported PostCSS plugin factory in postcss-animatecss@1.0.2 contains an obfuscator.io-obfuscated payload that executes on every consumer build. When the plugin runs, it fetches a remote endpoint (URL built from an RC4/base64 string array hidden inside the module), reads a `message` field from the JSON response, base64-decodes it, and executes the result via `new Function('require', m)(require)` — giving the remote operator arbitrary Node.js code execution with full `require` access on the developer or CI host. A `setInterval(fn, 4000)` installed via a `new Function('return this')()` global reference re-invokes the fetch-and-eval loop every 4 seconds for the lifetime of the process, providing persistent adaptable C2. The outbound request also appends `Object.keys(options.features?...)` to the query string, leaking consumer plugin configuration to the endpoint. The package's declared purpose (adding `-webkit-` animate.css prefixes) requires no network I/O whatsoever; the fetch/eval/interval layer plus obfuscator.io string-array concealment is the classic supply-chain backdoor signature.\n","affected":[{"package":{"ecosystem":"npm","name":"postcss-animatecss"},"versions":["1.0.1","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"8ce719a4aaced0dfb73ed33b6ad19fa270aef4ba83a1b9551dcbf46208ab8ffa","tlsh":"204219acb49178485bf62af1d7df1446fa7995a338481580b1adc2983f32a198067f3d"},{"path":"package.json","sha256":"6fdf082fe457ad4f183471b5b3d228b45b3220a95950b3b0f010c3f99b7534bb","tlsh":"4d110633d6146d270bf8eea095690142fa425b1fa5748c07307f451c4fa626382aebb9"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/postcss-animatecss/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/postcss-animatecss/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010374","import_time":"2026-07-14T04:31:59.553512594Z","modified_time":"2026-07-14T03:37:31Z","sha256":"738c22eca129a28069de2e6a01f1897db0f7db302e5e3bd809e3bca62ee76abd","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-010373","import_time":"2026-07-14T04:31:59.459466712Z","modified_time":"2026-07-14T03:37:23Z","sha256":"adfcae16a606f0b7eccb6cd94c1d1d0b583b19021bb15d04161f3ca8855aba61","source":"amazon-inspector","versions":["1.0.2"]}]}}