🛡️ MAL-2026-12418 — postcss-animate-css-vars

Malicious code in postcss-animate-css-vars (npm)

Source: amazon-inspector

src/normalize-options.js is heavily obfuscated (RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison branches) while the rest of the package (index.js, plugin.js, root.js, declarations.js) is plain readable code. When the PostCSS plugin is instantiated (createPlugin -> normalizeOptions), the loader assembles an HTTPS URL from obfuscated string-array entries, appends keys from the caller-supplied options.features sub-object as query parameters, fetches a JSON response, base64-decodes its message field, and executes the decoded code with new Function('require', code)(require) — arbitrary code execution in every downstream consumer's build/CI process. The loader also writes a wrapper file to the OS tmpdir (named with process.pid) containing require('<pkg>')(<options>); setInterval(()=>{},2147483647); and spawns process.execPath detached with stdio ignored and env LT1_STAGE1_CHILD=1, then calls child.unref(). The detached node child re-enters the loader branch, decoupling the fetch-and-eval from the parent build and keeping it alive on a ~24.8-day interval after PostCSS exits, enabling persistent staging beyond the build window. Package metadata (name postcss-animate-css-vars, description 'PostCSS plugin for animate.css', author 'Alex Rivera <[email protected]>', homepage cssanimation.dev) presents as a legitimate PostCSS ecosystem plugin, but the shipped code contains no animate.css handling in the obfuscated loader path — the metadata is cover for the loader.