Malicious npm packages that mimic popular PostCSS have been used to distribute a multi-layered Windows Remote Access Trojan (RAT) to developer environments. The packages, published by an npm named abdrizak, exploit typosquatting to mimic the legitimate postcss-selector-parser, which has over 150 million weekly downloads. The discovery highlights once again the serious risk facing software supply chains worldwide.
The three malicious npm packages detected are: aes-decode-runner-pro (145 downloads), postcss-minify-selector (256 downloads), and postcss-minify-selector-parser (615 downloads), with a total of 1,016 downloads across the cluster. They are presented as AES/custom-codec and depend on the legitimate postcss-selector-parser, which makes them look trustworthy on a superficial inspection.
See also: ZiChatBot Malware: Malicious PyPI Packages Target Windows and Linux
Security firm JFrog identified the threat through static analysis, revealing capabilities for command injection, persistence via registry, and credential theft from Google Chrome.
The attack chain is triggered as soon as a developer inserts the malicious package into their project. Embedded within the code is a JavaScript dropper that decrypts an encrypted data blob (AES-256-GCM) and writes a PowerShell script (settings.ps1) to disk, bypassing execution policies . This script acts as a downloader for the next stage of the payload, which it retrieves from the external server nvidiadriver[.]net using curl.exe.
Technical Analysis of npm RAT: How the Malware Works
The recovered payload is a ZIP (winPatch.zip), from which a Visual Basic Script (update.vbs) is extracted and executed via wscript.exe. The ZIP also includes a Python runtime, a Python loader (loader.py) and several Python extension modules (*.pyd) compiled with Nuitka. The Visual Basic Script sets up the Python environment on the compromised system and launches loader.py, which activates the main logic of the RAT.
See also: Malicious Laravel Packages on Packagist Install RAT
The RAT 's capabilities are implemented through specialized Python native extension modules: config.pyd contains constants, command IDs, and the URL of the C2 server ( 95.216.92[.]207:8080 ); api.pyd handles HTTP communication with the C2; audiodriver.pyd controls the main RAT orchestration loop; command.pyd creates host profiles, performs VM detection checks, file transfers, and shell command execution ; auto.pyd steals credentials and extension data from Google Chrome , bypassing app-bound encryption (ABE) , Windows DPAPI , and ChaCha20-Poly1305 protections ; and util.pyd acts as a helper module for tar/gzip files.
The existence of VM detection suggests that the RAT have taken steps to avoid analysis in sandbox environments.
According to The Hacker News , the case highlights how a small parser-like package can hide a multi-layered Windows payload while appearing to be bundled with legitimate build tools. JFrog researcher Radoslav Krehlik noted that the RAT uses VM detection and encrypted communication channels to maintain access, highlighting the risk of typosquatting in the npm ecosystem . Similar attacks have been carried out by state actors, such as the Sapphire Sleet group (North Korean hackers) who compromised an npm maintainer account to publish malicious npm packages .
See also: 'Mini Shai-Hulud': SAP-Related npm Packages Compromised with Credential Stealer
Protection
To protect against these threats, developers and organizations should take immediate action. First, immediately remove the malicious npm packages (postcss-minify-selector-parser, postcss-minify-selector, aes-decode-runner-pro) from all projects. Second, fully check dependency trees for transitive risks. Third, exclude network indicators: the nvidiadriver.net and the C2 server 95.216.92.207. Fourth, scan endpoints for the %TEMP%\winPatch.zip. Fifth, immediately change any credentials stored in Google Chrome, as the RAT aggressively bypasses modern cryptographic protections. Finally, implement stricter verification for npm packages, checking signatures and publisher history before each installation.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
