[email protected] is a malicious npm package that impersonates the legitimate postcss-initial plugin. Its index.js includes a heavily obfuscated payload that globally exposes require and module, imports Node.js modules (http, https, zlib, child_process), and queries Ethereum RPC and block explorer APIs (drpc.org, blockscout.com/api, stapi.io) to fetch attacker-controlled data staged on-chain. The fetched data is executed via child_process.spawn, enabling arbitrary code execution on the host system. This behavior is inconsistent with the expected functionality of a CSS transformation plugin and indicates a supply chain attack through typosquatting.

This malicious package enables remote code execution on systems that install and run [email protected]. By executing attacker-controlled payloads fetched from blockchain endpoints, it can compromise the host environment, potentially leading to full system compromise, data theft, or further malware deployment. The supply chain nature of this attack means that developers unknowingly incorporating this package into their projects risk introducing severe security breaches.

No official patch or remediation is currently documented for this package. Users should immediately remove [email protected] from their projects and dependency trees. Avoid installing packages with suspicious or typosquatted names. Verify package authenticity by checking the official repository and maintainers. Employ dependency scanning tools to detect malicious or suspicious packages. Monitor for updates from the npm registry or security advisories for any official remediation.