[email protected], 1.1.0, 2.0.0, and 2.1.0 is a name-confusion fork of the legitimate postcss-selector-parser npm package. It impersonates the original author and copies the source and license verbatim but includes a large obfuscated bundle that executes shell commands via child_process, which is unnecessary for its stated functionality. The package also uses bytenode to load obfuscated V8 bytecode files, making inspection difficult. This combination of impersonation, obfuscation, and execution of shell commands constitutes a supply-chain attack targeting developers who intended to install the legitimate package.

The malicious package can execute arbitrary shell commands on the developer's system due to the use of child_process exec and execSync calls. This can lead to compromise of the development environment, potential data theft, or further malware installation. The obfuscation and use of bytenode bytecode loading hinder detection and analysis, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should avoid installing selparsecss-selector versions 1.0.0, 1.1.0, 2.0.0, and 2.1.0. Instead, they should verify the authenticity of packages before installation, prefer the legitimate postcss-selector-parser package, and audit dependencies for suspicious or impersonated packages. Monitor package sources and use tools that detect malicious npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.