{"answers":{"affected":"1 open source package ship an affected version, including post-css-transfer.","exploited":"There is no known exploitation of MAL-2026-12417 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12417 is a malicious package in post-css-transfer, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12417 is a malicious package: post-css-transfer (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12417/ (Markdown: https://insights.sbomify.com/MAL-2026-12417/index.md)","id":"MAL-2026-12417","markdown":"https://insights.sbomify.com/MAL-2026-12417/index.md","name":"MAL-2026-12417","record":{"aliases":["GHSA-f5h9-q436-8chv"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On require/import, the appended block resolves a command-and-control IP by reading transactions of Ethereum address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a via public Ethereum RPC endpoints and the eth.blockscout.com API, decodes two IPv4 addresses from the transaction recipient bytes, fetches an XOR-encrypted payload over HTTP from those hosts (delivered in an x-payload-b64 header), and executes the decrypted payload via eval() and a detached `node -e` child process. Network, execution, and identifier primitives (http, child_process, spawn, the Ethereum address, method and header names) are written as \\uXXXX escapes and hidden behind ~1KB of whitespace padding after `module.exports = postcss;` to evade casual review.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in post-css-transfer (npm)","id":"MAL-2026-12417","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"post-css-transfer","purl":"pkg:npm/post-css-transfer","source":"MAL-2026-12417"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12417/"}