postcss-initialize-provider

{"modified":"2026-08-19T05:17:50Z","published":"2026-08-19T05:17:50Z","schema_version":"1.7.4","id":"MAL-2026-14261","summary":"Malicious code in postcss-initialize-provider (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16)\npostcss-initialize-provider@3.0.4 presents itself as a PostCSS plugin (README, badges, and repository links reference the legitimate maximkoretskiy/postcss-initial project), but index.js contains a heavily obfuscated payload (obfuscator.io-style 244-entry string array with rotation and _0x-prefixed identifiers) appended to the plugin code. Decoded strings show the payload captures require and module onto the global object (global['r']=require, global['m']=module), imports http/https/zlib/child_process, and queries Ethereum RPC and block-explorer endpoints (drpc.org, blockscout.com/api, stapi.io, with eth_getBlockByNumber / eth_getTransactionCount / module=account&action=txlist calls) to retrieve attacker-controlled data staged on-chain, then executes it via child_process.spawn and the captured require handle. A CSS transformation plugin has no legitimate need for child_process, Ethereum RPC access, or global capture of require/module. The package name typosquats postcss-initial and reuses that project's presentation to distribute the loader.\n","affected":[{"package":{"ecosystem":"npm","name":"postcss-initialize-provider"},"versions":["3.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"2f244ade98ebb5ae72391b253630c30dbcde4ec3c186a49483c56bcf14eafc92","tlsh":"81f231147b81b5411307ebbb771bb4e5e4aa0e99b184404bf11cfc88e7a5632ebb1b74"},{"path":"package.json","sha256":"afa59a34d18617ec0eef84d1ed0468c41b3eda9882a27e927feabbe707d4dad6","tlsh":"87112324cc698e7365e9626684281542f334ed0b4a98bc1c73af524e4f1e07b55bdbec"}],"package_integrity":[{"filename":"postcss-initialize-provider-3.0.4.tgz","hashes":{"sha1":"a71cf1e9346ed27175b0bdd9fff838f8d503b019","sha512_sri":"sha512-TnXG8Jp1uSlukEPLnu1pV88WmnJsVa0j+YBhtrPHDOtfZ6YW1jEPlqLFJwS/hU4ZIVjEGsqzqnG/9qAfvhbUhQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/postcss-initialize-provider/v/3.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018376","import_time":"2026-08-19T05:44:45.188545843Z","modified_time":"2026-08-19T05:17:50Z","sha256":"85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16","source":"amazon-inspector","versions":["3.0.4"]}]}}