The postcss-initial-provider npm package version 3.0.4 includes a malicious code block in its index.js file that is obfuscated using unicode escapes to evade detection. Upon requiring the package, it queries multiple public Ethereum RPC endpoints for the latest transaction of a specific hardcoded wallet address. It parses the transaction's destination address bytes as two IPv4 addresses, then fetches an XOR-encrypted payload from these IPs over HTTP. The payload is decrypted and executed both via eval() within the process and by spawning a detached Node.js process with the payload as code. This allows arbitrary code execution controlled by the attacker, with the command-and-control (C2) infrastructure dynamically controlled via on-chain Ethereum transactions. The malicious behavior is unrelated to the package's intended PostCSS plugin functionality, indicating a supply-chain compromise.

Any system that installs postcss-initial-provider version 3.0.4 is at risk of arbitrary code execution by an attacker. This can lead to full compromise of the host environment, unauthorized access, data theft, or further malware deployment. The attacker can dynamically change the C2 servers by updating the Ethereum blockchain transactions, making detection and mitigation more difficult. This supply-chain attack affects all users of this specific package version.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid installing postcss-initial-provider version 3.0.4. Audit and verify dependencies in your supply chain to exclude this compromised package. Monitor for any signs of compromise if this package was previously installed. Check vendor advisories or trusted security sources for updates or official fixes.