Supply chain · npm · High

Critical Malicious npm Package: 'postcss-theme-provider' Targets Crypto Wallets

Threat Engine Auto-Feed · data current as of 2026-08-07

The npm package 'postcss-theme-provider' version 1.0.2 contains malicious code that executes upon import. It uses a sophisticated 'EtherHiding' technique to fetch and execute arbitrary JavaScript payloads, posing a critical supply-chain risk, particularly for cryptocurrency users.

  • Package: npm / postcss-theme-provider
  • Affected versions: = 1.0.2
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Crypto / wallet targeting

Version 1.0.2 of the npm package 'postcss-theme-provider' was found to contain malicious code. This code executes immediately when the package is required, querying public Ethereum RPC endpoints to retrieve attacker-controlled IP addresses. These IP addresses are then used to fetch and execute an XOR-encrypted JavaScript payload, which is run as a detached child process.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is compromised to deliver malicious code. The attacker uses a 'dead-drop' mechanism, specifically leveraging Ethereum transactions, to dynamically update the command-and-control (C2) server IP addresses. This allows the attacker to serve new payloads to any system that imports the malicious package, making detection and mitigation more challenging due to the rotating C2 infrastructure.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has installed or imported 'postcss-theme-provider' version 1.0.2

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing vulnerable versions to be installed
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency versions
  • Use of internal package mirrors that may not filter out malicious versions
  • Automated build processes that do not vet new package versions

Blast-radius scenarios

  • An attacker could achieve remote code execution on developer machines or build servers.
  • The malicious payload could exfiltrate sensitive data, including cryptocurrency wallet keys or credentials.
  • Compromised systems could be used as part of a botnet or for further network penetration.

What to do (defensive)

Detect

  • Scan existing projects for 'postcss-theme-provider' version 1.0.2 in package.json and lock files.
  • Monitor network traffic for connections to known public Ethereum RPC endpoints (e.g., eth-mainnet.public.blastapi.io, eth.blockscout.com) from unexpected processes.
  • Implement software composition analysis (SCA) tools to identify known malicious packages in your dependency tree.
  • Review package integrity and checksums for all dependencies before deployment.

Contain

  • Immediately quarantine any systems found to have installed 'postcss-theme-provider' version 1.0.2.
  • Block network access to public Ethereum RPC endpoints from non-essential systems.
  • Isolate build environments and developer workstations that may have pulled the malicious package.
  • Revoke credentials and rotate API keys used on potentially compromised systems.

Remediate

  • Remove 'postcss-theme-provider' version 1.0.2 from all projects and dependency trees.
  • Update package.json to pin exact, known-good versions of all dependencies and regenerate lock files.
  • Perform a full forensic analysis on any system that installed the malicious package to identify the extent of compromise.
  • Rebuild affected systems from trusted images and ensure all dependencies are verified.

Frontier verdict — High

Prioritize immediate detection and removal of 'postcss-theme-provider' v1.0.2 due to critical remote code execution risk via dynamic C2.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.