MAL-2026-10687 — Malicious code in selparsecss-selector (npm)

selparsecss-selector@2.1.0 is a name-confusion copy of postcss-selector-parser that contains obfuscated code and scaffolding capable of loading opaque V8 bytecode. The source describes this combination as a supply-chain attack shape targeting developers who intended to install postcss-selector-parser.