🛡️ MAL-2026-10614 — postcss-selector-minify

Malicious code in postcss-selector-minify (npm)

Source: amazon-inspector

Package is published as postcss-selector-minify (a word-order permutation of cssnano's widely used postcss-minify-selectors) and registers itself to PostCSS under the legitimate plugin's id postcss-minify-selectors, so consumers who mistype or misremember the cssnano plugin name receive a different publisher's package that self-identifies as the real one. On require(), the main entry performs a bare side-effect import of layerd-unit-codec-parser/cjs-runner (return value discarded) before any other work, and replaces the de-facto-standard postcss-selector-parser with layerd-unit-codec-parser/selector-parser (the standard parser is demoted to devDependencies). layerd-unit-codec-parser is an obscure package whose name has no relation to CSS or PostCSS; the /cjs-runner submodule path is shaped specifically to execute code on load. Installing this package silently pulls layerd-unit-codec-parser into the consumer's dependency tree and runs its cjs-runner module on every require of the wrapper.