The 'layerd-unit-codec-parser' npm package (version 1.0.0) masquerades as 'postcss-minify-selector-parser', mimicking the legitimate 'postcss-selector-parser'. It re-exports the real package's API to appear benign. However, it includes a large AES-GCM encrypted payload along with the decryption key and salt, which it decrypts and executes dynamically using 'new Function'. This obfuscation conceals arbitrary JavaScript code execution with access to the require function, enabling potentially malicious actions in the consumer's environment. The malicious code execution is triggered via commands like 'npm start', 'npm run decode', 'node cjs-runner.js', or by invoking the exported run functions.

This package enables arbitrary code execution in the environment where it is installed and run, potentially allowing attackers to execute any code with the privileges of the user running the package. This can lead to compromise of the system, data theft, or further malicious activity. The obfuscation via AES encryption does not prevent analysis since the key and salt are included, making the payload easily decrypted and executed.

No official patch or remediation is currently available. Users should avoid installing or running the 'layerd-unit-codec-parser' package, especially version 1.0.0. Verify package authenticity before use and prefer official, well-known packages. Remove any installations of this package from your environment. Monitor for any unexpected executions of this package's code and audit systems for potential compromise if it was previously installed.