postcss-processor-utils@1.0.3

Analysis

Package postcss-processor-utils@1.0.3 is a trojanized npm package impersonating a Tailwind CSS typography plugin. The publisher [account] The package contains no lifecycle hooks, so execution occurs when the module is required as a Tailwind plugin. The src/token-loader.js file implements a XOR-based decryption routine (deriveKey from package name+version) that reads encrypted base64 payload chunks from data/design-tokens.json under _encrypted.chunks (18 chunks totalling ~25KB), writes the decoded JS to os.tmpdir()/postcss-processor-cache/compat-{platform}-{arch}.js, and require()'s it — a classic obfuscated payload delivery chain. The src/styles.js also includes a suspicious _cssColorProbe IIFE that fingerprints the system (arch, platform, execPath) into the temp directory. No network exfiltration was observed at the static level, but the encrypted payload is opaque and could execute arbitrary code at runtime. Investigation showed no canary tokens, no NPM_TOKEN/GITHUB_TOKEN strings, and no .npmrc references — the threat is the payload delivery mechanism itself, not credential theft at the static layer.