MAL-2026-14261 Malicious code in postcss-initialize-provider (npm)

[email protected] presents itself as a PostCSS plugin (README, badges, and repository links reference the legitimate maximkoretskiy/postcss-initial project), but index.js contains a heavily obfuscated payload (obfuscator.io-style 244-entry string array with rotation and _0x-prefixed identifiers) appended to the plugin code. Decoded strings show the payload captures require and module onto the global object (global['r']=require, global['m']=module), imports http/https/zlib/child_process, and queries Ethereum RPC and block-explorer endpoints (drpc.org, blockscout.com/api, stapi.io, with eth_getBlockByNumber / eth_getTransactionCount / module=account&action=txlist calls) to retrieve attacker-controlled data staged on-chain, then executes it via child_process.spawn and the captured require handle. A CSS transformation plugin has no legitimate need for child_process, Ethereum RPC access, or global capture of require/module. The package name typosquats postcss-initial and reuses that project's presentation to distribute the loader.