css-compat-layer@11.0.9

Analysis

css-compat-layer@11.0.9 masquerades as a CSS normalization library for Swiper — its package description, keywords and README describe only CSS cross-browser fixes — but the shipped bundles dist/index.js and dist/index.mjs are ~190 KB javascript-obfuscator output implementing a remote-controlled cryptocurrency wallet drainer. When loaded in a browser the code fingerprints the host (GPU renderer, plugin count, mobile/emulation hints, referrer, page URL) and opens a WebRTC peer connection with a data channel to a remote operator endpoint; the default endpoint is assembled at runtime from obfuscated string fragments into an hxxps://st…static…com host and can be overridden via window.__ENDPOINT__. It then executes commands received over that channel, including eth_requestAccounts, wallet_switchEthereumChain, eth_sendTransaction, personal_sign, eth_signTypedData_v3/v4, ERC-20 approve (selector 0x095ea7b3) and EIP-2612 Permit signing (EIP-712 domain/message carrying owner, spender, value, nonce and deadline), and reports the victim's wallet address, chainId, token, spender, value, txHash and signature back to the operator, with periodic heartbeats. None of this behaviour relates to the package's stated CSS purpose.