The postcss-animatecss package versions 1.0.1 and 1.0.2 include an obfuscated payload that runs on every build. It fetches a remote endpoint using a URL constructed from hidden RC4/base64 strings, retrieves a base64-encoded message, and executes it via a dynamically created function with full require access. This creates a persistent backdoor by re-invoking the fetch-and-execute loop every 4 seconds. The outbound request also leaks plugin configuration data. The malicious behavior is concealed by obfuscation and is unrelated to the package's legitimate purpose of adding CSS prefixes.

This malicious code allows remote attackers to execute arbitrary Node.js code on developer or continuous integration environments where the affected package is used. It provides persistent remote code execution with full module loading capabilities, potentially compromising the build environment and any sensitive data or credentials accessible there. Additionally, it leaks configuration details to the attacker, increasing the risk of further targeted attacks.

No official patch or remediation is currently documented. Users should immediately stop using postcss-animatecss versions 1.0.1 and 1.0.2. Remove these versions from all projects and CI pipelines. Replace with a trusted, verified version or alternative package. Monitor for any signs of compromise in development and CI environments. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.