@ai_/autoprefixers @1.2.0

Summary

@ai_/autoprefixers is a typosquat of the popular autoprefixer package. On require, lib/autoprefixer.js loads node:child_process via a base64-hidden string ( bm9kZTpjaGlsZF9wcm9jZXNz ), fetches AES-256-CBC ciphertext over plain HTTP from http://player.sweeprovider.org/getKey.php and a key from http://player.sweeprovider.org/generateRandomKey.php, decrypts them using a helper ( utils.prefixInfo ) with a hardcoded key suffix 47e01aba1e12cf6d , and passes the plaintext to child_process.exec (also base64-hidden as ZXhlYw== ). Any consumer that installs and imports this package receives arbitrary attacker-controlled shell command execution on their machine, with the C2 endpoint free to change the delivered payload at any time.

Source: amazon-inspector (5c2804af51ff476ec1ebdcec7b393366a66015ada2d2453a2acfbd21f99890f2)