postcss-theme-provider @1.0.2

Summary

packages/core/src/index.ts and plugin.ts (compiled into dist/index.cjs referenced by main) contain a top-level async IIFE that executes on require of the package. The loader queries public Ethereum RPC endpoints (eth-mainnet.public.blastapi.io, eth.blockscout.com) for the latest transaction from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f01210063e9aDC2490Ef1a), decodes two IPv4 addresses from the transaction's to field bytes, fetches XOR-encrypted JavaScript from http://<ip>:443/0x/cls and /0x/ls, decrypts it, calls eval on the result, and spawns a detached node -e <payload> child process via child_process.spawn with unref() . Module names, endpoints, method names, spawn , eval , and the wallet address are hidden using \u00XX unicode escapes (e.g. require("\u0068\u0074\u0074\u0070") , require("\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073") ) while legitimate PostCSS code in the same file uses normal string literals. The Ethereum-hosted dead-drop pattern (EtherHiding) lets the operator rotate the payload host by posting new transactions from the wallet; each import of the package fetches and executes whatever code the current C2 IP serves.

Source: amazon-inspector (d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40)