postcss-motion-utils@3.2.7

Analysis

The package index.js is a heavily obfuscated remote-code-execution dropper. It contains a large base64-encoded payload array that is decoded at runtime and executed via new Function("require", ...), giving the decoded payload access to Node.js require. The code also makes a fetch call to retrieve and execute additional remote code. The package name combosquats a PostCSS utility but contains no CSS processing logic — the entire 164KB file is obfuscated malware. The package attempted network egress at runtime (DNS resolution to a sinkholed endpoint), confirming the payload is a live C2-capable dropper.