Fake postcss npm Package Drops Full Windows RAT

JFrog's researchers have taken apart a malicious npm package that spent its short life pretending to be one of the JavaScript ecosystem's workhorses. The genuine article, postcss-selector-parser, gets pulled down more than 150 million times a week. The imposter, postcss-minify-selector-parser, was named closely enough to survive a quick glance from a tired developer running through a dependency review. It even listed the real package among its own dependencies, which is the kind of detail you only bother with if you want to look respectable.

What happened on install

The payload fired as soon as the package was imported. A file that should have held parser logic instead contained an encrypted blob and an AES-256-GCM decoder. Once decoded, it wrote a PowerShell script to disk and executed it. That script reached out to nvidiadriver[.]net, a domain dressed up as a legitimate driver download site, and pulled down a ZIP file masquerading as a Windows patch.

Inside the ZIP was a bundled Python runtime alongside a set of Nuitka-compiled modules, all launched by a VBScript bootstrapper. The end result was a Windows remote access trojan that phoned home over encrypted HTTP, persisted through a registry run key, checked whether it was running inside a virtual machine, and offered the usual menu of remote shell, file transfer and data theft features.

The RAT was also built specifically to harvest saved logins from Chrome, including support for the browser's newer app-bound encryption. That's not a trivial feature to add, and it suggests whoever built this was paying attention.

Not a one-off

JFrog tracked down two more packages in the same cluster, postcss-minify-selector and aes-decode-runner-pro, all published by an account using the name abdrizak. At the time of writing, the lookalike was still sitting on the npm registry. Anyone who pulled it in is being advised to remove the package, sweep the temp folder and registry for leftovers, and rotate any credentials that machine had access to. Realistically, on a developer box, that's a long list.

Why this one matters

The RAT itself is fairly standard. The interesting bit is the patience of the impersonation. Matching the keywords, listing the genuine library as a dependency, picking a name that survives a casual glance: none of that is technically hard, but it shows an attacker who understands how developers actually scan their package.json files. Quickly.

Build pipelines are increasingly where attackers want to be. One compromised developer machine often opens doors that phishing the CEO never would. A dev's laptop has source code, signing keys, cloud credentials, registry tokens, and a chain of trust into production. The juicier targets aren't always the loudest ones.

And npm, by sheer volume, is a generous hunting ground. Typosquatting and lookalike packages aren't new, but the production values keep creeping up. The days of a malicious package being a single ugly postinstall script are long gone.

If your team installs from npm, this is a fine prompt to revisit how new dependencies actually get reviewed before they land in a project. Not the policy document version of the review. The one that happens at 4pm on a Friday.