motion-forge-css @1.0.1

Summary

Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single ~105KB obfuscator.io-packed bundle as its main entry (index.js), loaded on every require('motion-forge-css'). The bundle uses a 912-entry rotated string array, string-decoder, self-defending / anti-debug wrapper, and an inline base64 alphabet — none of which are required to add CSS vendor prefixes. The bundle also contains a plaintext Function( dynamic code-construction primitive alongside string-array entries for require , Buffer , process , constructor , and prototype , which is the standard toolkit for reconstructing Node built-ins by name and executing a decoded payload at import time. The combination of deep obfuscation, dynamic-code-execution primitives, and runtime lookup of Node internals in a package whose stated purpose is trivial text substitution is inconsistent with a legitimate CSS plugin and matches the shape of a hidden install/require-time loader.

Source: amazon-inspector (6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa)