MAL-2026-14261

    Dashboard / Malicious Package / MAL-2026-14261

    MAL-2026-14261

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in postcss-initialize-provider (npm)

    Details: Source: amazon-inspector (85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16) [email protected] presents itself as a PostCSS plugin (README, badges, and repository links reference the legitimate maximkoretskiy/postcss-initial project), but index.js contains a heavily obfuscated payload (obfuscator.io-style 244-entry string array with rotation and _0x-prefixed identifiers) appended to the plugin code. Decoded strings show the payload captures require and module onto the global object (global['r']=require, global['m']=module), imports http/https/zlib/child_process, and queries Ethereum RPC and block-explorer endpoints (drpc.org, blockscout.com/api, stapi.io, with eth_getBlockByNumber / eth_getTransactionCount / module=account&action=txlist calls) to retrieve attacker-controlled data staged on-chain, then executes it via child_process.spawn and the captured require handle. A CSS transformation plugin has no legitimate need for child_process, Ethereum RPC access, or global capture of require/module. The package name typosquats postcss-initial and reuses that project's presentation to distribute the loader.

    References: https://www.npmjs.com/package/postcss-initialize-provider/v/3.0.4

    Affected packages

    Package

    Name: postcss-initialize-provider

    Purl: pkg:npm/postcss-initialize-provider

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.4