The postcss-animatecss npm package versions 1.0.1 and 1.0.2 contain malicious code that executes arbitrary Node.js commands on developer or CI hosts. The package includes an obfuscated payload that fetches and executes remote code every 4 seconds, establishing a persistent command-and-control channel. This behavior leaks consumer plugin configuration data to the attacker and is unrelated to the package's intended functionality.