Malicious code in postcss-initialize-plugin (npm)
postcss-initialize-plugin is a typosquat of the legitimate postcss-initial package that contains obfuscated malicious code. On require, the payload queries Ethereum RPC endpoints for transaction data and executes arbitrary code via child_process.spawn, giving an attacker with control of a specific Ethereum address remote code execution on any machine that installs the package.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed or required postcss-initialize-plugin from npm
- Ecosystems
- Attack vectors
- Affected entities
- postcss-initialize-pluginTyposquat of postcss-initial; contains obfuscated malicious payload
postcss-initialize-plugin is a typosquatting attack targeting the legitimate postcss-initial PostCSS plugin. The malicious package copies the README, repository URL, and author metadata verbatim from the legitimate maximkoretskiy/postcss-initial project to appear authentic.
The package's index.js file contains the legitimate plugin source but appends an obfuscated payload using obfuscator.io with string-array encoding and control-flow flattening. Upon require, the deobfuscated code imports http, https, zlib, and child_process modules and contains hardcoded Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, blastapi.io, and process.env.ETH_RPC_URL).
When loaded, the payload queries these Ethereum endpoints for transaction data associated with a hardcoded address beginning 0xa322E5f3, decompresses the returned bytes using zlib, and passes the decoded content to child_process.spawn. This mechanism grants arbitrary code execution to the operator of that Ethereum address on any system that installs or requires the package.
A legitimate PostCSS plugin has no legitimate reason to contact Ethereum RPCs, spawn child processes, or obfuscate its logic. The attack was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- postcss-initialize-plugin
- Domains
- eth.drpc.org
- ethereum-rpc.publicnode.com
- 1rpc.io
- blastapi.io
Remediation
- Immediately uninstall postcss-initialize-plugin from all systems and projects
- Audit npm install logs and dependency trees to identify all affected systems and projects
- Review and revoke any credentials or secrets that may have been exposed on affected machines
- Reinstall the legitimate postcss-initial package if PostCSS initial-value functionality is required
- Implement package name verification and typosquat detection in dependency management workflows
- Monitor affected systems for signs of unauthorized code execution or data exfiltration
Sources
- GitHub Advisory GHSA-v5q4-xw6r-qm2r · GitHub Advisory Database
Cite this entry
"Malicious code in postcss-initialize-plugin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-postcss-initialize-plugin-npm-t5k2kq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package