Malicious code in postcss-theme-provider (npm)

The postcss-theme-provider npm package contained obfuscated malicious code in its compiled distribution files (dist/index.cjs, referenced by the main entry point). The code executed automatically as a top-level async IIFE when the package was imported.\n\nThe malicious loader queried public Ethereum RPC endpoints to retrieve the latest transaction from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f01210063e9aDC2490Ef1a). It decoded two IPv4 addresses from the transaction's to field bytes, then fetched XOR-encrypted JavaScript payloads from attacker-controlled HTTP servers at those addresses. The payloads were decrypted and executed via eval(), with a detached child process spawned via child_process.spawn with unref().\n\nThe attack used unicode escape sequences (\u00XX) to obfuscate module names, endpoints, method names, and the wallet address, while legitimate PostCSS code in the same file used normal string literals. This Ethereum-hosted dead-drop pattern (EtherHiding) allowed the operator to rotate the payload host by posting new transactions from the wallet, enabling dynamic C2 updates without redeploying the package.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.