post-css-transfer is a typosquat of the legitimate postcss npm package. Its main entry file (lib/postcss.js) contains an appended obfuscated Immediately Invoked Function Expression (IIFE) that, upon require or import, reads transactions from a specific Ethereum address using public RPC endpoints and the eth.blockscout.com API. It decodes two IPv4 addresses from transaction recipient bytes, fetches an XOR-encrypted payload over HTTP from those IPs delivered in a custom header, decrypts the payload, and executes it using eval() and a detached 'node -e' child process. The code uses Unicode escapes and whitespace padding to hide network, execution, and identifier primitives, making casual review difficult.

The malicious code enables remote command execution on systems that install and run the post-css-transfer package version 0.0.1. This can lead to arbitrary code execution, potential system compromise, and unauthorized network communications with attacker-controlled infrastructure. The obfuscation and use of blockchain-based command-and-control mechanisms complicate detection and analysis.

Users should avoid installing or using the post-css-transfer package version 0.0.1. Since this is a typosquat package, ensure that dependencies reference the legitimate 'postcss' package. There is no official patch or fix available for post-css-transfer, as it is a malicious package rather than a legitimate software component. Remove any instances of post-css-transfer from projects and dependency trees immediately.