Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT
Summary: Researchers at JFrog found a set of malicious npm packages published over the past month by a user named "abdrizak" that pose as PostCSS tools, including names like postcss-minify-selector-parser that reference the legitimate postcss-selector-parser library with more than 127 million weekly downloads. Each package carries a JavaScript dropper that writes and runs a PowerShell script, which downloads a ZIP from nvidiadriver[.]net containing a Python runtime, a Nuitka-compiled loader, and a VBS script that launches a Windows RAT able to steal Chrome credentials and extension data and communicate with a command-and-control server at 95.216.92[.]207:8080.
Key Takeaway: The packages were still available on npm at the time of writing, and the name borrows credibility from a library with 127 million weekly downloads, so a developer pulling a lookalike build dependency can hand an attacker a full credential-stealing RAT on their machine.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026