The animate-css-vite package version 1.0.1 includes an obfuscated function in plugin.js that, when instantiated, constructs a URL and fetches remote code at runtime. The fetched response is base64-decoded and executed dynamically using new Function with require passed in scope. This allows the remote operator to execute arbitrary code inside the consumer's build process. The obfuscation uses a 130-entry RC4 string array with multiple decoders and a self-defending console-hook stub to conceal the network destination and execution logic. Such behavior is unexpected and malicious for a PostCSS plugin, which normally does not fetch or execute remote code.

Consumers of animate-css-vite version 1.0.1 who include this package in their build process risk arbitrary code execution by a remote attacker. This can lead to compromise of the build environment, potential injection of malicious code into built artifacts, and further downstream supply chain attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using animate-css-vite version 1.0.1 and consider removing or replacing this package from their build dependencies.