The npm package post-css-transfer version 0.0.1 is a typosquatting malicious package that appends obfuscated code to the legitimate postcss module. This code fetches command-and-control IP addresses by reading Ethereum blockchain transactions, retrieves an XOR-encrypted payload from those hosts, decrypts it, and executes it via a detached Node.js child process. The malicious code is heavily obfuscated to evade detection.