MAL-2026-12417

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/post-css-transfer/MAL-2026-12417.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12417
Published
2026-08-05T12:46:11Z
Modified
2026-08-05T13:35:46.109439493Z
Summary
Malicious code in post-css-transfer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4)

post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On require/import, the appended block resolves a command-and-control IP by reading transactions of Ethereum address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a via public Ethereum RPC endpoints and the eth.blockscout.com API, decodes two IPv4 addresses from the transaction recipient bytes, fetches an XOR-encrypted payload over HTTP from those hosts (delivered in an x-payload-b64 header), and executes the decrypted payload via eval() and a detached node -e child process. Network, execution, and identifier primitives (http, child_process, spawn, the Ethereum address, method and header names) are written as \uXXXX escapes and hidden behind ~1KB of whitespace padding after module.exports = postcss; to evade casual review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.1"
            ],
            "id": "IN-MAL-2026-014753",
            "import_time": "2026-08-05T13:08:43.72023183Z",
            "modified_time": "2026-08-05T12:46:11Z",
            "source": "amazon-inspector",
            "sha256": "f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4"
        }
    ]
}
References
Credits

Affected packages

npm / post-css-transfer

Package

Name
post-css-transfer
View open source insights on deps.dev
Purl
pkg:npm/post-css-transfer

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "post-css-transfer-0.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-vJqB8lUqJLIr8kZlGvI1Al4BDUdHqDtZUruEZUrmImc7O3a7ZeX86ojT2QB3exDduoiSiZGV0/gs42DutrKPyQ==",
                "sha1": "c82e60959ee45b9095f30698a27ebcea8256beae"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "lib/postcss.js",
            "tlsh": "464274f027a5ac7a83316984cc346d0de6b4dd65580fe039f82f7899df691e08792b6c",
            "sha256": "8d803beec4f1d1074349a0130095640ad5934f98be60fc9d501d744241416f21"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/post-css-transfer/MAL-2026-12417.json"