Malicious code in postcss-processor-utils (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b0253c4f750443ba47f0ab61347fa85a1659b847190a85757575e904966636da) On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs under `_encrypted.chunks` using a key derived from the package name and version, writes the decoded JavaScript to os.tmpdir()/postcss-processor-cache/compat-<platform>-<arch>.js, and immediately require()s the result. The XOR-with-package-identity scheme exists only to defeat static scanners; the executed bytes are whatever the publisher chooses to embed. Separately, src/styles.js contains a top-level IIFE (`_cssColorProbe`) that runs on require, writes process metadata (arch, platform, execPath, pid, timestamp) to /tmp/.tailwind-color-space-v2/, and is gated by `!process.env.CI &&!process.env.TAILWIND_DISABLE_TELEMETRY` so it only fires on developer machines. The same file (lines 67-74) contains an author comment block reading 'STEALTH PAYLOAD AREA / Replace the example below with your actual virus logic. / This executes once on first build after npm install.' — the author self-identifies the location as a payload slot. The package's exported API mimics @tailwindcss/typography (identical `prose` plugin, class names, modifiers, selectors) but is published under placeholder identity ('[email protected]', 'github.com/example-org/...'), positioning it as a Tailwind-typography lookalike to lure installs. Any project that installs and requires this package executes attacker-controlled JavaScript on developer (non-CI) hosts. ## Source: ghsa-malware (964d32bf7c4b15509607e1e7bce59d3c5a06ecf914bc1035f778163b0fe16e95) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
postcss-processor-utils version 1.0.2 is a malicious npm package that, upon being required, loads obfuscated JavaScript code decoded from embedded base64 blobs using a key derived from the package name and version. This decoded code is written to a temporary directory and immediately executed, allowing arbitrary attacker-controlled code execution on the host. Additionally, the package writes process metadata to a temporary directory on developer machines, excluding CI environments. The package impersonates the @tailwindcss/typography plugin to lure developers into installing it. The author explicitly left a 'STEALTH PAYLOAD AREA' comment indicating where malicious payload logic executes once after installation.
Potential Impact
Any project that installs and requires postcss-processor-utils version 1.0.2 will execute arbitrary attacker-controlled JavaScript code on the developer's machine outside of CI environments. This can lead to compromise of the developer environment, potential theft of sensitive information, or further malicious activity initiated from the developer's system. The threat is limited to developer machines and does not affect CI pipelines due to environment gating.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove postcss-processor-utils version 1.0.2 from their projects and avoid installing packages from untrusted or suspicious sources. Verify package authenticity before installation, especially for packages mimicking popular plugins. Monitor for and remove any files created under temporary directories such as os.tmpdir()/postcss-processor-cache/ and /tmp/.tailwind-color-space-v2/. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in postcss-processor-utils (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b0253c4f750443ba47f0ab61347fa85a1659b847190a85757575e904966636da) On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs under `_encrypted.chunks` using a key derived from the package name and version, writes the decoded JavaScript to os.tmpdir()/postcss-processor-cache/compat-<platform>-<arch>.js, and immediately require()s the result. The XOR-with-package-identity scheme exists only to defeat static scanners; the executed bytes are whatever the publisher chooses to embed. Separately, src/styles.js contains a top-level IIFE (`_cssColorProbe`) that runs on require, writes process metadata (arch, platform, execPath, pid, timestamp) to /tmp/.tailwind-color-space-v2/, and is gated by `!process.env.CI &&!process.env.TAILWIND_DISABLE_TELEMETRY` so it only fires on developer machines. The same file (lines 67-74) contains an author comment block reading 'STEALTH PAYLOAD AREA / Replace the example below with your actual virus logic. / This executes once on first build after npm install.' — the author self-identifies the location as a payload slot. The package's exported API mimics @tailwindcss/typography (identical `prose` plugin, class names, modifiers, selectors) but is published under placeholder identity ('[email protected]', 'github.com/example-org/...'), positioning it as a Tailwind-typography lookalike to lure installs. Any project that installs and requires this package executes attacker-controlled JavaScript on developer (non-CI) hosts. ## Source: ghsa-malware (964d32bf7c4b15509607e1e7bce59d3c5a06ecf914bc1035f778163b0fe16e95) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
postcss-processor-utils version 1.0.2 is a malicious npm package that, upon being required, loads obfuscated JavaScript code decoded from embedded base64 blobs using a key derived from the package name and version. This decoded code is written to a temporary directory and immediately executed, allowing arbitrary attacker-controlled code execution on the host. Additionally, the package writes process metadata to a temporary directory on developer machines, excluding CI environments. The package impersonates the @tailwindcss/typography plugin to lure developers into installing it. The author explicitly left a 'STEALTH PAYLOAD AREA' comment indicating where malicious payload logic executes once after installation.
Potential Impact
Any project that installs and requires postcss-processor-utils version 1.0.2 will execute arbitrary attacker-controlled JavaScript code on the developer's machine outside of CI environments. This can lead to compromise of the developer environment, potential theft of sensitive information, or further malicious activity initiated from the developer's system. The threat is limited to developer machines and does not affect CI pipelines due to environment gating.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove postcss-processor-utils version 1.0.2 from their projects and avoid installing packages from untrusted or suspicious sources. Verify package authenticity before installation, especially for packages mimicking popular plugins. Monitor for and remove any files created under temporary directories such as os.tmpdir()/postcss-processor-cache/ and /tmp/.tailwind-color-space-v2/. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10540
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff6468715ace432f1ba6
Added to database: 07/14/2026, 09:20:36 UTC
Last enriched: 07/14/2026, 09:34:03 UTC
Last updated: 07/27/2026, 08:07:54 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.