The postcss-animate-css-vars npm package version 2.0.3 includes a malicious loader in src/normalize-options.js that uses obfuscation techniques such as RC4-decoded string arrays and rotating string shufflers. When instantiated, it constructs an HTTPS URL from obfuscated data and caller-supplied options, fetches a JSON response, base64-decodes a 'message' field, and executes the decoded code via new Function, enabling arbitrary code execution in downstream consumers' build or CI environments. Additionally, the loader writes a wrapper file to the OS temporary directory named with the process ID, which requires the package and sets an interval timer, then spawns a detached Node.js process with environment variable LT1_STAGE1_CHILD=1. This detached child process re-enters the loader code path, decoupling the fetch-and-execute cycle from the parent process and maintaining persistence for roughly 24.8 days after PostCSS exits. The package metadata falsely presents as a legitimate PostCSS plugin for animate.css, but the obfuscated loader contains no animate.css functionality, indicating the metadata is a cover for the malicious behavior.

This malicious package enables arbitrary code execution in every downstream consumer's build or continuous integration process, potentially allowing attackers to execute any code on affected systems. The persistence mechanism via a detached Node.js child process extends the attacker's foothold beyond the build window for nearly 25 days, increasing the risk of prolonged compromise. The obfuscation and remote code fetching complicate detection and analysis, posing a significant threat to supply chain security for projects depending on this package.

No official patch or remediation is currently documented. Users should immediately remove version 2.0.3 of postcss-animate-css-vars from their dependency trees and avoid using this package until a trusted, clean version is released. Conduct a thorough audit of build and CI environments for signs of compromise, including the presence of unexpected temporary files or detached Node.js processes. Monitor for updates from the package maintainer or npm security advisories for official fixes or guidance. Consider using package integrity verification tools and restricting network access during builds to prevent remote code fetching.