[email protected] includes an obfuscated PostCSS plugin factory that, when invoked, constructs a URL from an encoded string array and performs an HTTP fetch with retries. The response's 'message' field is base64-decoded and executed as JavaScript via a dynamic function call with full Node.js require access. This results in remote code execution within the developer's build process, enabling arbitrary attacker-controlled code execution. The obfuscation and remote code fetching are indicative of deliberate malicious intent.

Any project that installs and runs animatecss-postcss-plugin version 1.0.1 will execute attacker-controlled JavaScript code with the privileges of the build process. This can lead to compromise of the build environment, potential theft of sensitive information, injection of malicious code into the build artifacts, and further supply chain attacks.

No official patch or remediation is currently available for [email protected]. Users should immediately remove this package from their projects and avoid running builds that include it. Consider auditing dependencies for malicious code and replacing this plugin with a trusted alternative. Monitor vendor advisories for updates on remediation.