The 'postcss-minify-selector' npm package is a typosquatting malicious package that closely imitates the legitimate 'postcss-minify-selectors' plugin by name and internal identifiers. It declares a dependency on another typosquat package 'postcss-minify-selector-parser', and unconditionally requires a subpath module that executes side-effect code at load time. This behavior is characteristic of a lure-plus-dropper attack, where requiring the package silently executes malicious code. The package is confirmed to fully compromise any computer on which it is installed or run.

Any computer with this package installed or running is considered fully compromised. Attackers may gain full control, potentially accessing all stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is necessary. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is available. The package should be removed immediately from all systems. All secrets and keys stored on affected systems must be rotated from a different, secure computer. Because full compromise is likely, further forensic analysis and remediation may be required to ensure complete removal of malicious code.