Malicious npm Packages Disguised as PostCSS Tools Deploy Windows RAT

Cybersecurity researchers at JFrog have uncovered a set of malicious npm packages that masquerade as legitimate PostCSS tools to deliver a Windows-based remote access trojan (RAT). The packages, published by an npm user named ‘abdrizak’ over the past month, include ‘aes-decode-runner-pro’ (145 downloads), ‘postcss-minify-selector’ (256 downloads), and ‘postcss-minify-selector-parser’ (615 downloads). All remain available on npm as of writing.

The attack chain begins with a JavaScript dropper that writes and executes a PowerShell script (‘settings.ps1’), which downloads a ZIP archive from ‘nvidiadriver[.]net’ using curl.exe. The archive contains a Visual Basic Script (‘update.vbs’), a Python runtime, a Python loader (‘loader.py’), and several Python extension modules (*.pyd) compiled with Nuitka. The VBS script sets up the Python environment and launches the loader, which triggers the RAT’s core logic.

The RAT is capable of gathering host information, stealing credentials from Google Chrome, collecting data from Chrome extensions, executing shell commands, and downloading/uploading files to a command-and-control server at ‘95.216.92[.]207:8080’. These capabilities are implemented through Python native extension modules: config.pyd (constants and C2 URL), api.pyd (HTTP C2 communication), audiodriver.pyd (main orchestration), command.pyd (host profiling, VM checks, file transfer, shell execution), auto.pyd (Chrome credential and extension theft, bypassing app-bound encryption), and util.pyd (archive helpers).

JFrog noted that this case demonstrates how small parser-like packages can conceal multi-stage Windows payloads while appearing related to legitimate build tools with massive weekly usage. The discovery coincides with other campaigns targeting the npm ecosystem, including a package delivering the MYRA Linux RAT, a package impersonating Google’s Stitch AI design tool to steal developer credentials, and a cluster of packages delivering a dropper binary on Windows. Additionally, a supply chain attack targeting the ‘gonex-AI/Understand-Anything’ knowledge graph tool was linked to the North Korean PolinRider operation, which uses obfuscated JavaScript in compromised GitHub repositories to deliver BeaverTail and InvisibleFerret malware.

Users who have installed any of these packages are advised to remove them immediately, remove any artifacts, and rotate credentials from impacted developer machines.