PostCSS npm typosquats deliver a Nuitka-compiled Python RAT with Chrome DPAPI credential theft
JFrog Security Research disclosed (2026-06-22) three malicious npm packages published by the account abdrizak — postcss-minify-selector-parser, postcss-minify-selector and aes-decode-runner-pro — that typosquat the legitimate postcss-selector-parser (150M+ weekly downloads) (JFrog, 2026-06-22; The Hacker News, 2026-06-23). On import, each package's index.js decrypts an AES-256-GCM blob and runs a JavaScript dropper that writes and executes a PowerShell downloader (settings.ps1); PowerShell pulls a Windows payload from an attacker-controlled host, a VBScript bootstrapper (update.vbs) extracts an archive, and a Nuitka-compiled Python 3.10 RAT (chost.exe loading loader.py plus six .pyd extension modules) activates. The RAT performs RC4-encrypted HTTP POST C2, registry Run-key persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, VM detection via WMI and adapter-MAC heuristics, remote shell, file transfer, and Chrome credential and extension-data theft via a DPAPI / app-bound-encryption bypass.
Why it matters to us: This is the npm typosquat-to-RAT pattern aimed squarely at developer endpoints and CI/CD runners — the highest-trust hosts in a software supply chain. Mapped to T1195.001/T1195.002 (Supply Chain Compromise), T1059.001 (PowerShell), T1027 (obfuscation — AES + Nuitka), T1547.001 (Registry Run Key), T1555.003 (Credentials from Web Browsers). Detection concepts (no IOCs): alert on node/npm/npx parent processes spawning powershell.exe (Sysmon EID 1 with parent-image filter); wscript.exe/cscript.exe executing from %TEMP%; new HKCU\...\Run values written by a Node toolchain; and Python runtimes in %TEMP% making outbound HTTP POST. Remediation is not "remove the package" — any host that installed these versions should have all browser-stored and developer credentials rotated and be treated as compromised.
The npm publisher observed during the investigation was abdrizak. During the review, we found three related packages: aes-decode-runner-pro, postcss-minify-selector, postcss-minify-selector-parser
The decoded blobs we analyzed from postcss-minify-selector-parser and aes-decode-runner-pro both lead to the same PowerShell downloader and Windows payload chain
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Execution TA0002
T1059.001Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Persistence TA0003
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Privilege Escalation TA0004
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Credential Access TA0006
T1555.003Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.