css-animation-utils@1.0.1

Analysis

css-animation-utils@1.0.1 is a trojanized PostCSS plugin that functions as a remote-code-execution dropper. The package is heavily obfuscated using javascript-obfuscator (dictionary array, _0x identifiers, base64-encoded string arrays, self-modifying control flow). On require(), the module's top-level code uses fetch() to retrieve a payload from a remote host and executes it via new Function(). Runtime analysis confirmed the package attempted to resolve a remote hostname via DNS, indicating active C2 communication. The package has no lifecycle hooks — the malicious code runs immediately when the module is loaded.