The postcss-initial-provider npm package version 3.0.4 contains malicious code that executes arbitrary attacker-controlled payloads on any host that installs it. The package includes obfuscated code that queries Ethereum public RPC endpoints for transactions from a hardcoded wallet address, extracts IP addresses from the transaction data, fetches an XOR-encrypted payload from those IPs, decrypts it, and executes it both in-process and as a detached Node.js process. This behavior is unrelated to the package's legitimate functionality and represents a supply-chain compromise.