MAL-2026-10687

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f4f8e230628f3622bf88bcd590f98f8065a99ea3e71ef1bf3c330439b7671e1f) selparsecss-selector@2.1.0 is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid' <pyramid.info@gmail.com> while the LICENSE-MIT, source tree, API, and CHANGELOG are copied verbatim from the upstream postcss-selector-parser (Ben Briggs). The tarball ships dist/util/webpack.min.js, a ~40KB obfuscator.io-packed bundle with a rotated 757-entry string array and an RC4+base64+XOR string decoder, whose top-level IIFE destructures exec and execSync from child_process, branches on values returned by the os module, and calls process.exit(1) on specific conditions. A CSS-selector parser has no functional need for child_process shell execution. Additionally, propPaths.js and selectors/wrapper.js reconstruct filenames such as 'wrapper.js' and the extension '.jsc' from CSS-hex-escape sequences via an unesc helper, and the package declares bytenode as a runtime dependency; bytenode registers a require hook for opaque V8-bytecode.jsc files, providing a loader path for code that cannot be inspected as source. The combination — impersonated identity, obfuscated child_process-execution bundle, and hex-obfuscated bytenode load scaffolding — is a supply-chain attack shape targeting developers who intended to install postcss-selector-parser.