MAL-2026-10614 Malicious code in postcss-selector-minify (npm)

Package is published as postcss-selector-minify (a word-order permutation of cssnano's widely used postcss-minify-selectors) and registers itself to PostCSS under the legitimate plugin's id postcss-minify-selectors, so consumers who mistype or misremember the cssnano plugin name receive a different publisher's package that self-identifies as the real one. On require(), the main entry performs a bare side-effect import of layerd-unit-codec-parser/cjs-runner (return value discarded) before any other work, and replaces the de-facto-standard postcss-selector-parser with layerd-unit-codec-parser/selector-parser (the standard parser is demoted to devDependencies). layerd-unit-codec-parser is an obscure package whose name has no relation to CSS or PostCSS; the /cjs-runner submodule path is shaped specifically to execute code on load. Installing this package silently pulls layerd-unit-codec-parser into the consumer's dependency tree and runs its cjs-runner module on every require of the wrapper.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.