The postcss-theme-provider npm package version 1.0.2 contains malicious code that executes upon requiring the package. This code queries public Ethereum RPC endpoints for a transaction from a hardcoded attacker wallet, extracts IP addresses from the transaction data, fetches XOR-encrypted JavaScript payloads from these IPs, decrypts and evaluates them, and then spawns a detached Node.js process to run the payload. The malicious code uses Unicode escapes to obfuscate critical strings such as module names and method calls. The attacker can rotate the command-and-control server by posting new Ethereum transactions, enabling dynamic payload updates.