Excerpt
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads.
postcss-minify-selector-parser is not a classic one-character typo. Instead, it sits close enough to the legitimate package to look plausible during a quick dependency review. It uses the same postcss , selector , parser , and css keyword space, and it also depends on the real postcss-selector-parser .
At the time of this report, the package remained live and accessible.
The npm publisher observed during t…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by JFrog on research.jfrog.com.
On the same topics
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Attackers Target Agents via The Skill Supply Chainzenity.io · Published 6 Aug
- Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux ImplantTrend Micro · Added 2 Sep
