MAL-2026-13957

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-initialize-plugin/MAL-2026-13957.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13957
Published
2026-08-13T17:16:32Z
Modified
2026-08-13T17:30:12.424075206Z
Summary
Malicious code in postcss-initialize-plugin (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79)

postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from maximkoretskiy/postcss-initial, and the legitimate plugin source is present, but index.js has an appended obfuscator.io payload (rotating string array 0x240a, control-flow flattening) that runs on require. Deobfuscation recovers imports of http, https, zlib, and childprocess, along with a hardcoded list of Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, blastapi.io, plus process.env.ETHRPCURL) and Etherscan-style txlist query parameters for a hardcoded address beginning 0xa322E5f3. On load the payload queries these endpoints for transaction data tied to that address, decompresses the returned bytes with zlib (gzip/deflate/br), stashes require and module on global, and passes the decoded content to child_process.spawn — giving the operator of that Ethereum address arbitrary code execution on any machine that installs or requires this package. A legitimate PostCSS plugin has no reason to contact Ethereum RPCs, spawn child processes, or bury its logic behind a string-array decoder.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017640",
            "modified_time": "2026-08-13T17:16:32Z",
            "versions": [
                "3.0.4"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-13T17:24:45.559991774Z",
            "sha256": "c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79"
        }
    ]
}
References
Credits

Affected packages

npm / postcss-initialize-plugin

Package

Name
postcss-initialize-plugin
View open source insights on deps.dev
Purl
pkg:npm/postcss-initialize-plugin

Affected ranges

Affected versions

3.*
3.0.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-initialize-plugin/MAL-2026-13957.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "a7fa0472f650c2992f56ab15d4fd7b62b369cffa4f38438f74e0884dde09b959",
            "tlsh": "67e25284b7d0a440030b6abbbb1bf4e5e96a0cad75844acbf11dbd84f766326e4f1531"
        },
        {
            "path": "package.json",
            "sha256": "b480987f118f924eacc09fc80bc91efbdb62d74ed577f600f042770920dc9566",
            "tlsh": "f0113614cc6d8e7365e9626684281142e334e94b4a98bc1c73af524e4f1e07b91bdbec"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "db50ecc3a724cd175989e67fd7a3872282eaced1",
                "sha512_sri": "sha512-Ayk7tXYRH+YRWYACYPpIXWpN4NmHS8fpOlcmwaBCBXJ0ybovrnKYgazXtiqGXIQPg7hVeq3dFLLkTnKUPLRzvg=="
            },
            "filename": "postcss-initialize-plugin-3.0.4.tgz"
        }
    ]
}