postcss-initialize-plugin

{"modified":"2026-08-13T17:16:32Z","published":"2026-08-13T17:16:32Z","schema_version":"1.7.4","id":"MAL-2026-13957","summary":"Malicious code in postcss-initialize-plugin (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79)\npostcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from maximkoretskiy/postcss-initial, and the legitimate plugin source is present, but index.js has an appended obfuscator.io payload (rotating string array _0x240a, control-flow flattening) that runs on require. Deobfuscation recovers imports of http, https, zlib, and child_process, along with a hardcoded list of Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, blastapi.io, plus process.env.ETH_RPC_URL) and Etherscan-style txlist query parameters for a hardcoded address beginning 0xa322E5f3. On load the payload queries these endpoints for transaction data tied to that address, decompresses the returned bytes with zlib (gzip/deflate/br), stashes require and module on global, and passes the decoded content to child_process.spawn — giving the operator of that Ethereum address arbitrary code execution on any machine that installs or requires this package. A legitimate PostCSS plugin has no reason to contact Ethereum RPCs, spawn child processes, or bury its logic behind a string-array decoder.\n","affected":[{"package":{"ecosystem":"npm","name":"postcss-initialize-plugin"},"versions":["3.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"a7fa0472f650c2992f56ab15d4fd7b62b369cffa4f38438f74e0884dde09b959","tlsh":"67e25284b7d0a440030b6abbbb1bf4e5e96a0cad75844acbf11dbd84f766326e4f1531"},{"path":"package.json","sha256":"b480987f118f924eacc09fc80bc91efbdb62d74ed577f600f042770920dc9566","tlsh":"f0113614cc6d8e7365e9626684281142e334e94b4a98bc1c73af524e4f1e07b91bdbec"}],"package_integrity":[{"filename":"postcss-initialize-plugin-3.0.4.tgz","hashes":{"sha1":"db50ecc3a724cd175989e67fd7a3872282eaced1","sha512_sri":"sha512-Ayk7tXYRH+YRWYACYPpIXWpN4NmHS8fpOlcmwaBCBXJ0ybovrnKYgazXtiqGXIQPg7hVeq3dFLLkTnKUPLRzvg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/postcss-initialize-plugin/v/3.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017640","import_time":"2026-08-13T17:24:45.559991774Z","modified_time":"2026-08-13T17:16:32Z","sha256":"c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79","source":"amazon-inspector","versions":["3.0.4"]}]}}