MAL-2026-13957
Dashboard / Malicious Package / MAL-2026-13957
MAL-2026-13957
Summary: Malicious code in postcss-initialize-plugin (npm)
Details: Source: amazon-inspector (c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79) postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from maximkoretskiy/postcss-initial, and the legitimate plugin source is present, but index.js has an appended obfuscator.io payload (rotating string array _0x240a, control-flow flattening) that runs on require. Deobfuscation recovers imports of http, https, zlib, and child_process, along with a hardcoded list of Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, blastapi.io, plus process.env.ETH_RPC_URL) and Etherscan-style txlist query parameters for a hardcoded address beginning 0xa322E5f3. On load the payload queries these endpoints for transaction data tied to that address, decompresses the returned bytes with zlib (gzip/deflate/br), stashes require and module on global, and passes the decoded content to child_process.spawn — giving the operator of that Ethereum address arbitrary code execution on any machine that installs or requires this package. A legitimate PostCSS plugin has no reason to contact Ethereum RPCs, spawn child processes, or bury its logic behind a string-array decoder.
Affected packages
Package
Name: postcss-initialize-plugin
Purl: pkg:npm/postcss-initialize-plugin
Affected ranges
Type: N/A
Events:
