postcss-animate-css-vars@2.0.3

Analysis

postcss-animate-css-vars is a trojanized PostCSS plugin that executes a multi-stage payload when loaded. The file src/normalize-options.js is heavily obfuscated (javascript-obfuscator) and, upon require(), writes a temporary .cjs file to the system temp directory containing the obfuscated payload, then spawns a detached child process (detached:true, windowsHide:true, stdio:'ignore') that re-executes the payload. The payload also fetches remote content and evaluates it dynamically. The package has no lifecycle hooks — the malicious code runs when any build pipeline loads the PostCSS plugin. The publisher email does not match the claimed author, indicating account takeover.