postcss-initialize-provider@3.0.4

Analysis

postcss-initialize-provider@3.0.4 is a trojanized clone of the legitimate postcss-initial plugin. The package's index.js contains the real postcss plugin code followed by a large obfuscated payload that executes on require(). The payload spawns child processes, reads the ETH_RPC_URL environment variable, and issues Ethereum JSON-RPC calls (eth_getBlock, eth_getBalance) against a list of RPC endpoints. It beacons to C2 infrastructure reachable via the hosts stapi[.]io and ut[.]com/api, with a command path under :443/0x/cl, and handles transaction/address data (strings 'address=' and 'transactio'). The obfuscated code also performs gzip/deflate/brotli decompression of responses, consistent with a multi-stage crypto-drainer implant.