Malicious Postcss-Animate-Utils Package Found in Antfarm Tech Repository
A malicious secondary dependency, @aaron205whitmore/postcss-animate-utils version 1.0.2, has been identified in Antfarm Tech's "proof_of_dev" repository, allowing for remote code execution.
Antfarm Tech "proof_of_dev" contains the malicious package @aaron205whitmore/postcss-animate-utils version 1.0.2. This package arrives as a secondary dependency via animatecss-tailwind-adapter.
Analysis shows the package connects to remote IP address 153.75.81.2. The script pulls base64-encoded payloads and runs them inside the Node.js environment. Using the require function, this code allows remote code execution on the host machine.
The package has the SHA-1 hash 183f39ef3531ad688f168c81e25b528b55630d67. Anyone who cloned the repository or ran npm install needs to check their local development environments.
Reports are underway to notify GitHub and the npm registry.