postcss-initialize-plugin@3.0.4

Analysis

postcss-initialize-plugin@3.0.4 is a combosquat of the legitimate postcss-initial PostCSS plugin. The real plugin code is present, but a heavily obfuscated payload is injected into the module factory and executes immediately when the package is required (i.e. during any PostCSS build). The payload monitors the Ethereum blockchain for transactions to the attacker-controlled wallet 0xa322E5f3... by querying public RPC endpoints (eth-mainnet[.]drpc[.]org, eth-mainnet[.]public[.]blastapi[.]io, ethereum-rpc[.]publicnode[.]com, or the ETH_RPC_URL env var) with eth_blockNumber/eth_getBlockByNumber/eth_getTransactionCount. It derives C2 host IPs from the wallet-address bytes (0xa322E5f3 -> 163[.]34[.]229[.]243) and downloads XOR-encrypted second-stage payloads from hxxps://163[.]34[.]229[.]243:443/0x/ls and hxxps://163[.]34[.]229[.]243:443/0x/cl, evaluates them, and spawns detached `node -e` processes. Command/exfil traffic uses ?module=account&action=txlist&address=... query parameters.