Obfuscated remote-code loader disguised as a postcss/animate.css Vite plugin. The entire payload is one obfuscated line at plugin.js:116 inside a function misleadingly named reportConfiguredVariables (plugin.js:115), invoked from createPlugin at plugin.js:120 and exported as the package entry point via index.js:8-9. Deobfuscation (custom-alphabet base64 + RC4, string-array rotation k=104) shows it: hijacks console.log/warn/info/error/exception/table/trace and resolves the global object via {}.constructor('return this')() for anti-analysis; decodes a rotated, base64-hidden host string to 162.141.78.95:1224; POSTs to http://162.141.78.95:1224/debugCheck with a 60s AbortController and up to 10 retries; then base64-decodes the response's 'message' field and executes it via new Function('require', code)(require), yielding arbitrary remote code execution with full Node module access. On failure it prints the decoy string 'Tailwind engine failed to load after all retries'. Critically, there is NO install hook: the payload executes at build time when Vite invokes the plugin factory, so install-script auditing will not catch it. Port 1224 is the signature C2 port of the DPRK-attributed Contagious Interview / BeaverTail-InvisibleFerret cluster. Publisher m.jamestech0000 (michaeljamestech0000@outlook.com) is a same-day throwaway with this as its only package; the declared repository github.com/bumpvite/animate-css-vite does not exist.