{"answers":{"affected":"1 open source package ship an affected version, including postcss-initialize-plugin.","exploited":"There is no known exploitation of MAL-2026-13957 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13957 is a malicious package in postcss-initialize-plugin, published on 13 Aug 2026."},"fix_prompt":"MAL-2026-13957 is a malicious package: postcss-initialize-plugin (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13957/ (Markdown: https://insights.sbomify.com/MAL-2026-13957/index.md)","id":"MAL-2026-13957","markdown":"https://insights.sbomify.com/MAL-2026-13957/index.md","name":"MAL-2026-13957","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from maximkoretskiy/postcss-initial, and the legitimate plugin source is present, but index.js has an appended obfuscator.io payload (rotating string array _0x240a, control-flow flattening) that runs on require. Deobfuscation recovers imports of http, https, zlib, and child_process, along with a hardcoded list of Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, blastapi.io, plus process.env.ETH_RPC_URL) and Etherscan-style txlist query parameters for a hardcoded address beginning 0xa322E5f3. On load the payload queries these endpoints for transaction data tied to that address, decompresses the returned bytes with zlib (gzip/deflate/br), stashes require and module on global, and passes the decoded content to child_process.spawn — giving the operator of that Ethereum address arbitrary code execution on any machine that installs or requires this package. A legitimate PostCSS plugin has no reason to contact Ethereum RPCs, spawn child processes, or bury its logic behind a string-array decoder.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in postcss-initialize-plugin (npm)","id":"MAL-2026-13957","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"postcss-initialize-plugin","purl":"pkg:npm/postcss-initialize-plugin","source":"MAL-2026-13957"}],"products":null,"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13957/"}