Malicious code in css-nesting-transform (npm)

[email protected] was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi the same account that published [email protected] on 2026-10-06. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of...