GCVE-110-OSM-2026-5812

This package is a typosquat of the legitimate 'postcss-minify-selector-parser' but contains no actual PostCSS functionality — its description reveals it as a 'layered custom codec pipeline' with AES-GCM, which is a payload loader pattern. Two of its direct dependencies ('encode-decode-codec' and 'position-unit-codec') are confirmed malicious in OSM, indicating a coordinated multi-package attack chain. The publisher 'abdrizak' already has a confirmed malicious package (aes-decode-runner-pro, severity high), giving a publisherMaliciousRatio of 0.5. The use of `new Function('require', runnable)` in src/pipeline/custom-codec-pipeline.js is a classic dynamic code execution loader pattern — it executes remotely-sourced or decoded code with access to the module system. Rapid version publishing (10+ versions in ~24 hours) combined with no source repository and a 1-day-old package confirm adversarial operational tempo. Entrypoint: index.js (main: index.js) Payload: src/pipeline/custom-codec-pipeline.js Key findings: - Dynamic Base64 Decoding in src/aes/aes-gcm.js: "Buffer.from(ivB64, "base64")" - Dynamic Code Execution in src/pipeline/custom-codec-pipeline.js: "new Function("require", runnable)" - Publisher Has Other Malicious Packages - Rapid Version Publishing - Malicious Dependency Detected (OSM) in package.json IOCs: - payloadFileHash: 6a38f4170e8e82254423040d311c8164b3d928ebc00cd7a95a8f22bee75ce128