noelc-css-blender@2.2.1

Summary

noelc-css-blender@2.1.11 declares itself as a 'tiny ESM utility for blending CSS custom-property token maps' with zero dependencies, but ships two heavily obfuscated single-line files totaling roughly 460 KB: index.mjs (~291 KB) and build-cache.mjs (~177 KB). Both consist of hex-named identifiers (_0x...) referencing large custom-encoded string arrays rather than readable code; the declared merge-two-token-maps functionality would require on the order of a dozen lines of plain JavaScript. The files carry fabricated 'auto-generated' header comments that misstate the package identity: index.mjs claims to be auto-generated by noelc-css-blender@2.2.1 (a different version than the actual 2.1.11 package), and build-cache.mjs claims to be auto-generated by tailwindcss-theme-kit@0.2.0, an unrelated package name. The headers additionally include 'restore from package-lock if corrupted' phrasing that functions as cover text discouraging inspection. package.json sets main: index.mjs, so any consumer that requires or imports noelc-css-blender executes the full obfuscated bundle at module load; there are no install lifecycle hooks, so the auto-executed surface is import-time rather than install-time. The string arrays use a custom (non-standard base64/XOR) encoding, so the specific sinks (network destinations, filesystem reads, child_process invocations) could not be extracted verbatim. The combination — massive obfuscated payload, trivial declared purpose, fabricated build-artifact header naming a different package, and import-time auto-execution via main — matches the carrier shape of credential-stealer / backdoor payloads rather than a legitimate CSS helper.

Source: amazon-inspector (1af88de104874d73dc5e8853fec7d4ca8b0c2c1dfa26a3cff9e44fac7eb30ea6)