animate-css-vite@1.0.1

Analysis

animate-css-vite@1.0.1 is a trojanized PostCSS plugin. When loaded (required), the plugin.js file executes an obfuscated async function that constructs a URL from encoded string constants, fetches a remote payload via HTTP with a 60-second timeout, base64-decodes the response, and executes it via new Function('require', code)(require), giving the remote server full access to Node.js APIs. The legitimate autoprefixer/vendor-prefix functionality is a facade. The C2 URL is dynamically constructed from obfuscated data and is not visible as a plaintext string in the source.