Malicious code in postcss-initialize-provider (npm)
postcss-initialize-provider@3.0.4 on npm contains malicious obfuscated code that typosquats the legitimate postcss-initial package. The payload captures require and module globals, queries Ethereum RPC endpoints for attacker-controlled data, and executes it via child_process.
- Disclosed
- Last updated
- Blast radius
- Any npm project that installed postcss-initialize-provider@3.0.4
- Ecosystems
- Attack vectors
- Affected entities
- postcss-initialize-provider · 3.0.4
postcss-initialize-provider@3.0.4 is a malicious npm package that impersonates the legitimate postcss-initial PostCSS plugin. The package uses identical README content, badges, and repository links to the legitimate project to deceive users into installing it.
The package's index.js contains heavily obfuscated code (obfuscator.io-style with a 244-entry string array and _0x-prefixed identifiers). When decoded, the payload captures the require and module functions onto the global object (global['r']=require, global['m']=module) and imports dangerous modules including http, https, zlib, and child_process.
The malicious code queries Ethereum RPC endpoints (drpc.org, blockscout.com/api, stapi.io) using calls like eth_getBlockByNumber, eth_getTransactionCount, and module=account&action=txlist to retrieve attacker-controlled data staged on-chain. This data is then executed via child_process.spawn using the captured require handle. A legitimate CSS transformation plugin has no legitimate need for child_process access, Ethereum RPC queries, or global capture of require/module.
The package was identified by the OpenSSF malicious-packages project and credited to Amazon Inspector.
Indicators of compromise
- Packages
- postcss-initialize-provider@3.0.4
- Domains
- drpc.org
- blockscout.com
- stapi.io
Remediation
- Immediately remove postcss-initialize-provider from all projects and dependencies
- Audit npm install logs and lock files for any installation of postcss-initialize-provider@3.0.4
- Review any systems where this package was installed for signs of compromise, including unexpected child processes, network connections to Ethereum RPC endpoints, or unauthorized code execution
- Use the legitimate postcss-initial package instead
- Enable npm audit and dependency scanning to detect malicious packages
- Consider using npm package signature verification and allowlisting trusted publishers
Sources
- GitHub Advisory GHSA-6475-p63g-9p6p · GitHub Advisory Database
Cite this entry
"Malicious code in postcss-initialize-provider (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-postcss-initialize-provider-npm-aids56
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package