MAL-2026-14261

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-initialize-provider/MAL-2026-14261.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14261
Published
2026-08-19T05:17:50Z
Modified
2026-08-19T06:00:10.803122840Z
Summary
Malicious code in postcss-initialize-provider (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16)

postcss-initialize-provider@3.0.4 presents itself as a PostCSS plugin (README, badges, and repository links reference the legitimate maximkoretskiy/postcss-initial project), but index.js contains a heavily obfuscated payload (obfuscator.io-style 244-entry string array with rotation and 0x-prefixed identifiers) appended to the plugin code. Decoded strings show the payload captures require and module onto the global object (global['r']=require, global['m']=module), imports http/https/zlib/childprocess, and queries Ethereum RPC and block-explorer endpoints (drpc.org, blockscout.com/api, stapi.io, with ethgetBlockByNumber / ethgetTransactionCount / module=account&action=txlist calls) to retrieve attacker-controlled data staged on-chain, then executes it via childprocess.spawn and the captured require handle. A CSS transformation plugin has no legitimate need for childprocess, Ethereum RPC access, or global capture of require/module. The package name typosquats postcss-initial and reuses that project's presentation to distribute the loader.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T05:44:45.188545843Z",
            "sha256": "85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16",
            "modified_time": "2026-08-19T05:17:50Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018376",
            "versions": [
                "3.0.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / postcss-initialize-provider

Package

Name
postcss-initialize-provider
View open source insights on deps.dev
Purl
pkg:npm/postcss-initialize-provider

Affected ranges

Affected versions

3.*
3.0.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-initialize-provider/MAL-2026-14261.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "2f244ade98ebb5ae72391b253630c30dbcde4ec3c186a49483c56bcf14eafc92",
            "tlsh": "81f231147b81b5411307ebbb771bb4e5e4aa0e99b184404bf11cfc88e7a5632ebb1b74",
            "path": "index.js"
        },
        {
            "sha256": "afa59a34d18617ec0eef84d1ed0468c41b3eda9882a27e927feabbe707d4dad6",
            "tlsh": "87112324cc698e7365e9626684281542f334ed0b4a98bc1c73af524e4f1e07b55bdbec",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "postcss-initialize-provider-3.0.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-TnXG8Jp1uSlukEPLnu1pV88WmnJsVa0j+YBhtrPHDOtfZ6YW1jEPlqLFJwS/hU4ZIVjEGsqzqnG/9qAfvhbUhQ==",
                "sha1": "a71cf1e9346ed27175b0bdd9fff838f8d503b019"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]