MSC-2026-6385

Obfuscated remote-code loader disguised as a postcss/animate.css Vite plugin. The entire payload is one obfuscated line at plugin.js:116 inside a function misleadingly named reportConfiguredVariables plugin.js:115, invoked from createPlugin at plugin.js:120 and exported as the package entry point...