Malicious code in animate-css-vite (npm)

The npm package animate-css-vite was found to contain malicious code embedded in its plugin.js file. The code uses heavy obfuscation—a 130-entry RC4 string array with multiple indirection decoders and console-hook stubs—to conceal its true functionality.\n\nWhen a consumer's build process instantiates the plugin (via the exported createPlugin factory), the malicious code constructs a URL at runtime, calls fetch() to retrieve remote content, base64-decodes the response, and executes it using new Function(param, decoded)(require) inside a retry loop (up to 10 attempts with 60-second timeouts). This grants the remote operator arbitrary code execution within the build environment.\n\nA legitimate PostCSS plugin for vendor prefixes and CSS variables has no legitimate reason to fetch and execute remote code. The presence of require in the execution scope allows the attacker to access the Node.js module system and filesystem, making this a critical supply chain risk.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-14226).