Malicious npm packages masquerading as PostCSS deliver a Windows RAT — a supply‑chain threat

Colleagues, please note: malicious npm packages have been discovered masquerading as PostCSS tools and delivering a Windows RAT.

- JFrog identified packages aes-decode-runner-pro, postcss-minify-selector and postcss-minify-selector-parser, published from a single account and available on npm.
- Mechanism: a JS dropper writes PowerShell, downloads a ZIP from an external server, deploys VBS and a Python runtime; the RAT exfiltrates Chrome data and extensions, executes commands and communicates with C2.
- I recommend removing suspicious packages, cleaning artifacts and rotating credentials.

Why this matters: small parser packages in the supply chain can conceal multi-stage threats.

What practices do you use to validate npm dependencies in CI/CD?

#cybersecurity #supplychain #npm #development